CVE-2026-50256

CVE-2026-50256 describes a stack-based buffer overflow vulnerability affecting the X.Org X server and Xwayland. This flaw stems from a discrepancy in buffer sizes during font alias resolution. Specifically, the X server allocates a 256-byte stack buffer for font alias names, while the `libXfont2` library can handle alias target names up to 1024 bytes. When a font alias name falls between 257 and 1023 bytes in length, the X server attempts to copy this name into its undersized 256-byte buffer without proper bounds checking. This action leads to a stack buffer overflow. The vulnerability could potentially be exploited to crash the server or, in scenarios where the X server operates with root privileges, facilitate privilege escalation.