CVE-2026-50259: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

Synopsis

A stack-based buffer overflow affects the X.Org X server and Xwayland. The flaw is reached locally by a low-privilege user: the XKB SetMap request handler declares a fixed-size 256-entry stack buffer indexed by a client-controlled value, and the bounds check is absent, allowing an out-of-bounds write. Successful exploitation crashes the X server or, when the X server runs as root, grants the attacker full root-level privilege escalation. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to send the malformed XKB SetMap request that triggers the overflow.

• Victim interactionNot required

  No user interaction is needed; the attacker sends the crafted request directly to the X server.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special memory layout assumptions are required.

Blast Radius

• Crashes the X server, disrupting the graphical session and any applications running under it.
• When the X server runs as root (a common deployment on RHEL 6 and 7), overwrites stack memory to redirect execution and gain full root privileges on the host.
• With root access, reads all files on the system including stored credentials, private keys, and application secrets.
• With root access, modifies or destroys persisted data and installs persistent backdoors.