Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local shell on RHEL host
  2. Delivery
    Plant font alias with 257-1023 byte target
  3. Exploit
    Trigger font alias resolution via X client
  4. Execution
    Overflow 256-byte server stack buffer
  5. Persist
    Hijack control flow in root X server
  6. Impact
    Execute payload as root

Vulnerability Assessment

Weakness
CWE
CWE-121
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local access to a system running the X.Org X server or Xwayland (RHEL 6/7/8/9/10 graphical or X-enabled deployments) with the ability to influence font alias configuration consumed by libXfont2, and the attacker must trigger resolution of a font alias whose target name length falls in the 257-1023 byte window - this is the exact bug condition called out in the description. Privilege escalation to root specifically requires that the X server is running as root (still common on traditional Xorg setups but not on rootless Xorg or pure Wayland sessions, which limits impact to a crash or to the X server's own user). Per the CVSS vector, the attacker needs some local privileges (PR:L) but no user interaction (UI:N), and headless servers without xorg-x11-server or xwayland installed are not exposed.
Impact

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity attack requiring only low privileges and no user interaction, with high impact on confidentiality, integrity, and availability - consistent with a privilege-escalation primitive on systems where the X server runs as root (still common on legacy and some embedded RHEL deployments). EPSS, KEV, and SSVC signals were not provided in the input, and no public exploit is identified at time of analysis, so this should be treated as a credible escalation risk rather than confirmed in-the-wild exploitation. The realistic priority is higher on multi-user workstations, jump hosts, and graphical RHEL systems where untrusted local users can supply font configuration; it is lower on headless servers without an X server and on systems running Xwayland under a non-root rootless model. Note that the CVSS vector specifies PR:L (some local privileges required), so an attacker still needs a foothold on the host.
Exploit ScenarioDerived

A local user with shell access on a RHEL workstation places a crafted font configuration referencing an alias whose target name is between 257 and 1023 bytes, then triggers font alias resolution (for example by connecting a client that requests the alias) against an X server running as root. The oversized name is copied into the 256-byte stack buffer, corrupting the return address and yielding either a denial of service via server crash or, with a working ROP/stack-smashing payload, code execution in the X server's root context. No public exploit is identified at time of analysis, but the bug class (CWE-121) and root-privileged target make a working exploit plausible to develop.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 05, 2026

Local privilege escalation in the X.Org X server and Xwayland stems from a stack-based buffer overflow during font alias resolution, where a 256-byte server-side stack buffer is overrun by libXfont2 alias target names of up to 1023 bytes. An authenticated local attacker who can influence font alias files can crash the server or, when the X server runs as root, escalate to root privileges. No public exploit is identified at time of analysis and CVSS is 7.8 (Local/Low complexity/Low privileges).

RemediationAI

Apply the upstream fix from xorg/xserver commit bb5158f962dc935e58ef8b4b5fcb31be201a6e07 (announced via https://lists.x.org/archives/xorg-announce/2026-June/003702.html) by upgrading xorg-x11-server and xwayland packages once the corresponding Red Hat errata are released - track availability and exact package versions via https://access.redhat.com/security/cve/CVE-2026-50256 and https://bugzilla.redhat.com/show_bug.cgi?id=2485380. Released patched RPM versions are not independently confirmed from the provided data, so vendor-released patch availability per RHEL stream should be verified against the Red Hat advisory before scheduling deployments. As compensating controls until patched packages are deployed, restrict who can supply or modify font configuration and alias files (typically under /etc/X11/fontpath.d, /usr/share/fonts, and per-user font directories) so unprivileged users cannot introduce attacker-controlled aliases, and avoid running the X server setuid-root by preferring rootless Xorg or Wayland sessions where the desktop stack supports it - note this may break legacy input drivers and remote display setups. On headless servers, consider uninstalling X.Org server and Xwayland entirely if not required, accepting the side effect of losing any GUI/forwarded-X functionality.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The X.Org X server (cpe X.Org xserver) and the Xwayland compatibility server delegate font handling to the libXfont2 library, which manages font alias resolution. The vulnerability is a classic CWE-121 stack-based buffer overflow caused by an inter-component size mismatch: the X server reserves a 256-byte fixed stack buffer to hold a font alias target name, but libXfont2 advertises a maximum alias target length of 1024 bytes. Because no length check is performed before copying the alias name from libXfont2 into the server's stack buffer, any alias name between 257 and 1023 bytes corrupts adjacent stack memory, including saved return addresses and frame pointers, enabling memory corruption attacks against the X server process. The upstream fix is tracked at gitlab.freedesktop.org/xorg/xserver commit bb5158f962dc935e58ef8b4b5fcb31be201a6e07.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Zero Day Initiative Advisories

ZDI-26-390 X.Org Server Font Alias Stack-based Buffer Overflow Privilege Escalation Vulnerability Jun 2026

Executive ViewAI

Why It Matters

CVE-2026-50256 affects X.Org X server and Xwayland, enabling authenticated local attackers to escalate privileges to root through a font alias buffer overflow. This poses material risk to desktop and workstation environments, particularly where local user accounts may be compromised or insider access exists.

Business Impact: High
Compensating Controls

Interim mitigations (patch unavailable): (1) Restrict read/write permissions on font configuration files to prevent modification by unprivileged users; (2) Run X server with non-root user account where operationally feasible; (3) Enforce strict local access controls and user account provisioning policies; (4) Maintain continuous monitoring of X.Org/Xwayland project advisories for patch availability. Apply vendor patch immediately upon release.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-50256 ADVISORY https://vuldb.com/vuln/368891 REF https://access.redhat.com/errata/RHSA-2026:26562 REF https://access.redhat.com/errata/RHSA-2026:26566 REF https://access.redhat.com/errata/RHSA-2026:26590 REF https://access.redhat.com/errata/RHSA-2026:26610 REF https://access.redhat.com/errata/RHSA-2026:26709 REF https://access.redhat.com/errata/RHSA-2026:28923 REF https://access.redhat.com/errata/RHSA-2026:29844 REF https://access.redhat.com/errata/RHSA-2026:36083 REF https://access.redhat.com/errata/RHSA-2026:36085 REF https://access.redhat.com/errata/RHSA-2026:36086 REF https://access.redhat.com/errata/RHSA-2026:36087 REF https://access.redhat.com/errata/RHSA-2026:36632 REF https://access.redhat.com/errata/RHSA-2026:36633 REF https://access.redhat.com/errata/RHSA-2026:36634 REF https://access.redhat.com/errata/RHSA-2026:36768 REF https://access.redhat.com/errata/RHSA-2026:36791 REF https://access.redhat.com/errata/RHSA-2026:36792 REF https://access.redhat.com/errata/RHSA-2026:36798 REF https://access.redhat.com/errata/RHSA-2026:38502 REF https://access.redhat.com/errata/RHSA-2026:38810 REF https://access.redhat.com/errata/RHSA-2026:46377 REF https://access.redhat.com/errata/RHSA-2026:46382 REF https://access.redhat.com/errata/RHSA-2026:46385 REF https://access.redhat.com/errata/RHSA-2026:46392 REF https://access.redhat.com/errata/RHSA-2026:46456 REF https://access.redhat.com/errata/RHSA-2026:46460 REF https://access.redhat.com/errata/RHSA-2026:46473 REF https://access.redhat.com/errata/RHSA-2026:49519 REF https://access.redhat.com/security/cve/CVE-2026-50256 REF https://bugzilla.redhat.com/show_bug.cgi?id=2485380 REF https://gitlab.freedesktop.org/xorg/xserver/-/commit/bb5158f962dc935e58ef8b4b5fcb31be201a6e07 REF https://lists.x.org/archives/xorg-announce/2026-June/003702.html REF https://redhat.atlassian.net/browse/PSIRTSUPT-16950 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50256.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy