X.Org X Server CVE-2026-50256: Brief Summary of a Stack Buffer Overflow in Font Alias Resolution

Introduction

A classic constant mismatch between the X.Org X server and the libXfont2 library has created a deterministic stack buffer overflow that gives local attackers up to 768 bytes of controlled overwrite during font alias resolution. On the many Linux systems that still run X.Org as root (legacy enterprise workstations, thin clients, kiosk systems, HPC clusters with X forwarding), this CVSS 7.8 vulnerability (CVE-2026-50256) is a direct path from low-privilege local access to full root compromise.

An anonymous researcher found the bug through the TrendAI Zero Day Initiative (ZDI-CAN-30136). It was disclosed on June 2, 2026, in a nine-CVE batch advisory covering the X.Org X server and Xwayland.

Technical Information

Root Cause: A Dangerous Constant Mismatch

The vulnerability exists because two components in the X display stack disagree on the maximum length of a font name. The X server defines XLFDMAXFONTNAMELEN as 256 bytes in dix/closestr.h and uses this constant to size stack-allocated buffers for font alias names. Meanwhile, libXfont2, the library that resolves font aliases from fonts.alias files, permits alias target names up to 1024 bytes (its own MAXFONTNAMELEN constant).

The mismatch leaves a 768-byte overflow window. Any font alias name between 257 and 1023 bytes is copied into the undersized 256-byte stack buffer, via memcpy in doListFontsAndAliases() or memmove in doListFontsWithInfo(), without any length validation. The excess bytes overwrite adjacent stack memory, including local variables and return addresses.

CVSS Vector Breakdown

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H says this about exploitability:

• Attack Vector: Local (AV:L): The attacker needs local access and an authenticated X client connection. The flaw is not remotely exploitable over the network, though SSH X11 forwarding could extend its reach.
• Attack Complexity: Low (AC:L): The overflow is deterministic and needs no race condition, special timing, or unusual configuration. Supply a font alias name of the right length and the overflow happens every time.
• Privileges Required: Low (PR:L): Standard user-level X session access is enough to trigger the flaw.
• User Interaction: None (UI:N): The overflow happens automatically during font alias resolution, with no action from the victim.
• Impact: High across all three dimensions (C:H/I:H/A:H): Successful exploitation means full compromise of the X server process.

Attack Flow

The exploitation chain is straightforward:

1. An attacker with an authenticated X client connection requests a font whose alias name is between 257 and 1023 bytes long.
2. During alias resolution, libXfont2 returns the alias target name (which can be up to 1024 bytes).
3. The X server copies this name into its 256-byte stack buffer using memcpy or memmove, with no length validation.
4. The excess bytes corrupt the stack frame, giving up to 768 bytes of controlled overwrite.
5. The attacker gets either a denial of service (crash) or, if the X server runs as root, privilege escalation through a return address overwrite.

Stack-based buffer overflows with this much controlled overwrite are among the best-understood exploitation primitives in security research. Return address overwrites and ROP chains are established techniques for this class of bug, and because the overflow is deterministic, the attacker needs no heap grooming or timing tricks.

CWE Classification

The CVE submission lists CWE-121 (Stack-based Buffer Overflow), while Red Hat classifies it as CWE-787 (Out-of-bounds Write). Both are accurate. CWE-121 is the child of CWE-787 that covers stack-allocated buffers.

Part of a Nine-Vulnerability Batch

CVE-2026-50256 was disclosed alongside eight other vulnerabilities in the same X.Org Security Advisory, all affecting X server prior to 21.1.23 and Xwayland prior to 24.1.12:

Three stack-based buffer overflows and three use-after-free vulnerabilities in one advisory point to systemic memory safety problems in the X server codebase.

Patch Information

A single, focused commit (bb5158f962dc935e58ef8b4b5fcb31be201a6e07) in the X.Org xserver repository fixes the vulnerability. It shipped in xorg-server 21.1.23 and xwayland 24.1.12 on June 2, 2026, and touches two files: dix/closestr.h (the constant definition) and dix/dixfonts.c (the code that copies font names).

Part 1: Correcting the Buffer Size Constant (dix/closestr.h)

The core fix raises XLFDMAXFONTNAMELEN to match the library's maximum:

-#define XLFDMAXFONTNAMELEN 256
+/* libXfont2 allows font names/aliases up to MAXFONTNAMELEN (1024) bytes in
+ * fonts.alias files. The server's pattern buffers must be large enough to
+ * hold resolved alias targets returned by the font library.
+ * ZDI-CAN-30136
+ */
+#define XLFDMAXFONTNAMELEN 1024

This enlarges the stack-allocated pattern[] buffer inside struct _LFWIstate (used by ListFontsWithInfo) so it can safely hold the longest name the font library might return.

Part 2: Adding Bounds Checks Before Copy Operations (dix/dixfonts.c)

As defense in depth, the developers also added explicit length checks before the resolved font names are copied, even with the buffer resized. Two functions got identical guard clauses.

In doListFontsAndAliases(), before the memcpy of the resolved alias name into the tmp_pattern buffer:

+ if (resolvedlen > XLFDMAXFONTNAMELEN) {
+     err = BadFontName;
+     goto ContBadFontName;
+ }
  memcpy(tmp_pattern, resolved, resolvedlen);

And in doListFontsWithInfo(), before the memmove that copies the name into c->current.pattern:

+ if (namelen > XLFDMAXFONTNAMELEN) {
+     err = BadFontName;
+     goto ContBadFontName;
+ }
  memmove(c->current.pattern, name, namelen);

In both functions, a name longer than XLFDMAXFONTNAMELEN now gets a clean BadFontName rejection instead of a blind write past the end of the buffer. With the buffer correctly sized and the bounds checked explicitly, the copy operations can never overflow their target buffers, whatever the font library returns.

Downstream distributions including Red Hat (tracked via Bugzilla #2485380) and Rocky Linux (RLSA-2026:11369) have shipped or are preparing corresponding package updates.

Affected Systems and Versions

The following products are affected:

• xorg-server: All versions prior to 21.1.23
• xwayland: All versions prior to 24.1.12

Systems running the X server as root (common in legacy configurations, RHEL 7 and earlier defaults, thin clients, kiosk systems, and HPC clusters with X forwarding) face the most severe risk, because in that configuration the overflow allows privilege escalation.

Red Hat has the following products under investigation as of June 5, 2026:

Red Hat has not published errata yet. Enterprise customers should watch the Red Hat Customer Portal for updates.

Vendor Security History

The X.Org project has a well-documented history of memory safety vulnerabilities, and its recent advisories show the pattern:

The June 2026 advisory is the third X.Org security batch in 2026 alone. The dominant vulnerability classes are still stack and heap buffer overflows and use-after-free conditions, all typical of C code without memory safety guarantees. The June 2026 batch also includes an incomplete fix for CVE-2025-26597, which shows that a patch can fail to fully resolve the underlying issue.

Peter Hutterer, a Red Hat employee, wrote the advisory and also discovered the DRI2 vulnerability in the same batch, a sign of Red Hat's continued investment in X server security maintenance. Seven of the nine vulnerabilities were reported through the TrendAI Zero Day Initiative, which has taken a systematic approach to auditing the X server codebase.

Organizations still relying on X11 have one more reason to evaluate a move to Wayland-only deployments where feasible.

References

• NVD: CVE-2026-50256
• Red Hat CVE Page: CVE-2026-50256
• Red Hat Bugzilla #2485380
• X.Org Security Advisory: June 2026
• oss-security Mailing List Disclosure
• Upstream Fix Commit
• Upstream Fix Commit (diff)
• X.Org Security Advisories History
• Gaming on Linux Coverage
• CISA Known Exploited Vulnerabilities Catalog