CVE-2026-50258: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

Synopsis

A stack-based buffer overflow exists in the X.Org X server and Xwayland, affecting all supported Red Hat Enterprise Linux versions. The flaw is reachable locally by any low-privilege account and requires no interaction from another user. Successful exploitation crashes the X server or, when the X server runs as root, grants full privilege escalation to the attacker. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to send malicious XKB key-type change requests to the X server.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker can trigger the overflow unilaterally.

• Attack complexityDetail

  The exploit is reliable and condition-free once local access is obtained; no race condition or specific memory layout is required.

Blast Radius

• Crashes the X server, disrupting all graphical sessions on the affected host.
• When the X server runs as root (a common configuration on older RHEL versions), the attacker gains full root-level code execution on the host.
• An attacker with elevated privileges can read sensitive files, credentials, or session tokens accessible to the root user.
• Persistence mechanisms or further lateral movement become available to the attacker following a successful privilege escalation.