CVE-2026-50258

EUVD-2026-34815

05.06.2026, 12:16

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 5%

Affected Products (NVD)

Vendor	Product	Version
x.org	x_server	𝑥 < 21.1.23
x.org	xwayland	𝑥 < 24.1.12
redhat	enterprise_linux	7.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Enterprise Linux 10	0:24.1.9-4.el10_2.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	0:24.1.5-6.el10_0.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	0:1.20.4-35.el7_9 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8	0:21.1.3-20.el8_10.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8	0:1.20.11-28.el8_10.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8	0:1.15.0-10.el8_10 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	0:1.20.10-5.el8_4 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	0:1.20.10-5.el8_4 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	0:1.20.11-8.el8_6 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	0:21.1.3-2.el8_6.7 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	0:1.20.11-8.el8_6 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	0:21.1.3-2.el8_6.7 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	0:1.20.11-19.el8_8 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	0:21.1.3-13.el8_8.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	0:1.20.11-19.el8_8 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	0:21.1.3-13.el8_8.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	0:24.1.9-4.el9_8.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	0:1.20.11-34.el9_8.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	0:1.15.0-7.el9_8.2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	0:1.20.11-21.el9_2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	0:21.1.3-10.el9_2.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	0:1.20.11-29.el9_4 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	0:22.1.9-8.el9_4.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	0:1.20.11-34.el9_6 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	0:23.2.7-6.el9_6.1 ≤ 𝑥 < *	ADP

Debian Releases

Debian Product

Codename

xorg-server

bookworm	vulnerable
bookworm (security)	vulnerable
bullseye	vulnerable
bullseye (security)	vulnerable
forky	2:21.1.23-1 fixed
sid	2:21.1.23-1 fixed
trixie	2:21.1.16-1.3+deb13u3 fixed
trixie (security)	2:21.1.16-1.3+deb13u3 fixed

xwayland

bookworm	ignored
forky	2:24.1.12-1 fixed
sid	2:24.1.12-1 fixed
trixie	ignored

Red Hat Enterprise Linux Releases

Red Hat Product

Release

tigervnc

RHEL 8	0:1.15.0-10.el8_10 fixed
RHEL 9	0:1.15.0-7.el9_8.2 fixed

tigervnc-icons

RHEL 8	0:1.15.0-10.el8_10 fixed
RHEL 9	0:1.15.0-7.el9_8.2 fixed

tigervnc-license

RHEL 8	0:1.15.0-10.el8_10 fixed
RHEL 9	0:1.15.0-7.el9_8.2 fixed

tigervnc-selinux

RHEL 8	0:1.15.0-10.el8_10 fixed
RHEL 9	0:1.15.0-7.el9_8.2 fixed

tigervnc-server

RHEL 8	0:1.15.0-10.el8_10 fixed
RHEL 9	0:1.15.0-7.el9_8.2 fixed

tigervnc-server-minimal

RHEL 8	0:1.15.0-10.el8_10 fixed
RHEL 9	0:1.15.0-7.el9_8.2 fixed

tigervnc-server-module

RHEL 8	0:1.15.0-10.el8_10 fixed
RHEL 9	0:1.15.0-7.el9_8.2 fixed

xorg-x11-server-Xdmx

RHEL 8	0:1.20.11-28.el8_10.2 fixed
RHEL 8.4 AUS	0:1.20.10-5.el8_4 fixed
RHEL 8.6 AUS	0:1.20.11-8.el8_6 fixed
RHEL 8.8 E4S	0:1.20.11-19.el8_8 fixed
RHEL 8.8 TUS	0:1.20.11-19.el8_8 fixed
RHEL 9	0:1.20.11-34.el9_8.2 fixed

xorg-x11-server-Xephyr

RHEL 8	0:1.20.11-28.el8_10.2 fixed
RHEL 8.4 AUS	0:1.20.10-5.el8_4 fixed
RHEL 8.6 AUS	0:1.20.11-8.el8_6 fixed
RHEL 8.8 E4S	0:1.20.11-19.el8_8 fixed
RHEL 8.8 TUS	0:1.20.11-19.el8_8 fixed
RHEL 9	0:1.20.11-34.el9_8.2 fixed

xorg-x11-server-Xnest

RHEL 8	0:1.20.11-28.el8_10.2 fixed
RHEL 8.4 AUS	0:1.20.10-5.el8_4 fixed
RHEL 8.6 AUS	0:1.20.11-8.el8_6 fixed
RHEL 8.8 E4S	0:1.20.11-19.el8_8 fixed
RHEL 8.8 TUS	0:1.20.11-19.el8_8 fixed
RHEL 9	0:1.20.11-34.el9_8.2 fixed

xorg-x11-server-Xorg

RHEL 8	0:1.20.11-28.el8_10.2 fixed
RHEL 8.4 AUS	0:1.20.10-5.el8_4 fixed
RHEL 8.6 AUS	0:1.20.11-8.el8_6 fixed
RHEL 8.8 E4S	0:1.20.11-19.el8_8 fixed
RHEL 8.8 TUS	0:1.20.11-19.el8_8 fixed
RHEL 9	0:1.20.11-34.el9_8.2 fixed

xorg-x11-server-Xvfb

RHEL 8	0:1.20.11-28.el8_10.2 fixed
RHEL 8.4 AUS	0:1.20.10-5.el8_4 fixed
RHEL 8.6 AUS	0:1.20.11-8.el8_6 fixed
RHEL 8.8 E4S	0:1.20.11-19.el8_8 fixed
RHEL 8.8 TUS	0:1.20.11-19.el8_8 fixed
RHEL 9	0:1.20.11-34.el9_8.2 fixed

xorg-x11-server-Xwayland

RHEL 8.4 AUS	0:1.20.10-5.el8_4 fixed
RHEL 9	0:24.1.9-4.el9_8.2 fixed

xorg-x11-server-Xwayland-devel

RHEL 9

0:24.1.9-4.el9_8.2

fixed

xorg-x11-server-common

RHEL 8	0:1.20.11-28.el8_10.2 fixed
RHEL 8.4 AUS	0:1.20.10-5.el8_4 fixed
RHEL 8.6 AUS	0:1.20.11-8.el8_6 fixed
RHEL 8.8 E4S	0:1.20.11-19.el8_8 fixed
RHEL 8.8 TUS	0:1.20.11-19.el8_8 fixed
RHEL 9	0:1.20.11-34.el9_8.2 fixed