CVE-2026-50256: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

Synopsis

A stack-based buffer overflow affects the X.Org X server and Xwayland, triggered during font alias resolution when a font alias name is between 257 and 1023 bytes long. The flaw is reachable locally by any low-privilege account without requiring victim interaction, because the X server copies the oversized alias target name into a 256-byte stack buffer without bounds checking. Successful exploitation crashes the X server or, where the server runs as root, enables privilege escalation to root. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attack vector is local (AV:L), so the attacker needs an existing shell or process on the host rather than any network path to the service.

• AuthenticationRequired

  A low-privilege local account is sufficient (PR:L); no elevated or administrative credentials are needed to trigger the overflow.

• Victim interactionNot required

  No user interaction is required (UI:N); the attacker can trigger the overflow without involving any other user.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special race conditions, memory-layout dependencies, or environmental preconditions beyond sending a crafted font alias name.

Blast Radius

• Crashes the X server or Xwayland process, interrupting all graphical sessions on the host.
• Where the X server runs as root, overwrites stack memory to redirect execution and gain root-level privileges on the system.
• A root-level compromise allows reading any file on the host, including credential stores, private keys, and application secrets.
• A root-level compromise allows modifying or deleting any file on the host, including system binaries and configuration.