Loading vulnerability…
Stack-based buffer overflow in X.Org and Xwayland XKB key types
CVE-2026-50258 is a stack-based buffer overflow in the X Keyboard Extension (XKB) subsystem of the X.Org X server and Xwayland. CheckKeyTypes() checks the minimum key-type width but fails to enforce the XkbMaxShiftLevel upper bound of 63 for non-canonical key types. An authenticated X client can submit oversized key types through XkbSetMap and subsequently trigger unsafe stack-buffer indexing during keyboard mapping updates through ChangeKeyboardMapping, XkbUpdateKeyTypesFromCore(), and XkbKeyTypesForCoreSymbols(). Multiple stack buffers are sized for XkbMaxShiftLevel * XkbNumKbdGroups, while attacker-controlled shift levels can exceed those limits. The flaw is an incomplete fix for CVE-2025-26597 and can cause display-server crashes or potentially execute code with the server's privileges. Affected upstream versions are X.Org X server before 21.1.23 and Xwayland before 24.1.12.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can crash the display server. Successful exploitation may permit code execution in the server process and root-level privilege escalation when the X server runs as root. Xwayland typically runs within an unprivileged user session, limiting the potential impact to user-level code execution and denial of service.
If you can’t patch tonight, do this now.
No temporary workaround is documented. Running the X server without root privileges limits the potential privilege-escalation impact but does not prevent the stack overflow, server crashes, or potential code execution within the server process. Installing the corrected packages is the recommended protection.
Patch, then assume compromise.
Upgrade to X.Org X server 21.1.23 or later and Xwayland 24.1.12 or later, or install distribution packages containing the backported fix. The fix makes CheckKeyTypes() reject key-type widths below 1 or above XkbMaxShiftLevel. For Debian stable (trixie), upgrade xorg-server packages to 2:21.1.16-1.3+deb13u3 or later. For affected EulerOS installations, install the applicable xorg-x11-server security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.