Loading vulnerability…
XKB SetMap stack buffer overflow in X.Org X server and Xwayland
CVE-2026-50259 is a stack-based buffer overflow in the XKB extension of the X.Org X server and Xwayland, resulting from an incomplete fix for CVE-2025-26597. _XkbSetMapChecks() declares a 256-element stack buffer, mapWidths, that CheckKeyTypes() indexes using client-controlled XKB SetMap fields. Insufficient validation permits a two-stage request sequence to write nine bytes beyond the buffer and corrupt the adjacent symsPerKey stack variable. Exploitation can crash the display server and potentially enable arbitrary code execution with root privileges when the X server runs as root.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash the X server and terminate graphical sessions for all users served by that instance. Stack corruption may also enable arbitrary code execution and local privilege escalation to root on deployments where the X server runs as root.
If you can’t patch tonight, do this now.
No workaround or temporary mitigation is documented in the Debian advisory; upgrading affected packages is recommended.
Patch, then assume compromise.
Upgrade to patched distribution packages or upstream xorg-server 21.1.23 and Xwayland 24.1.12 or later. The fix rejects requests when the computed nMaps exceeds the 256-element buffer capacity, aborting processing before an out-of-bounds write. Debian stable (trixie) installations should upgrade xorg-server to 2:21.1.16-1.3+deb13u3 or later. EulerOS and Rocky Linux installations should apply the corresponding vendor security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.