Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Obtain local user shell
  2. Delivery
    Connect to X server display
  3. Exploit
    Send crafted XKB key-type request with oversized shift levels
  4. Install
    Bypass CheckKeyTypes() validation
  5. C2
    Overflow stack buffer and hijack control flow
  6. Execute
    Execute shellcode in X server process
  7. Impact
    Gain root if Xorg runs as root

Vulnerability Assessment

Weakness
CWE
CWE-121
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Attacker must have local code execution as any user with the ability to connect to the running X server (authenticated local session per CVSS PR:L) - typically any logged-in user on the console or via SSH X11 forwarding to that display. The attacker must be able to send XKB extension requests, which is the default for connected X clients, and must redefine key types with non-canonical shift levels exceeding XkbMaxShiftLevel. Privilege escalation to root specifically requires the X server to be running as root (the traditional setuid-Xorg configuration on most legacy Linux desktops, multi-user servers, and VNC/XDMCP gateways); on modern systems running rootless Xwayland under a Wayland compositor, successful exploitation yields only same-user code execution plus a denial-of-service crash rather than root. No user interaction is required (UI:N) once the malicious client is running.
Impact

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a 7.8 base score reflecting local attack vector, low complexity, low privileges, and full CIA impact - consistent with a privilege escalation primitive rather than a remote takeover. EPSS and KEV data were not provided in the input, so widespread automated exploitation probability and confirmed in-the-wild use cannot be asserted; however, this CVE is explicitly an incomplete-fix follow-on to CVE-2025-26597, which raises real-world likelihood since the original class of bug attracted attention from XKB researchers and the regression path is documented in the upstream commit. The risk is highest on systems where Xorg still runs as setuid root (traditional Linux desktops, some VNC/RDP gateways, multi-user workstations, jump hosts), and materially lower on rootless Xwayland-only modern desktops where successful exploitation yields only same-user code execution and DoS. No public exploit identified at time of analysis, but a skilled attacker could derive one from the diff.
Exploit ScenarioDerived

A local user with an active X session - for example, a low-privileged shell user on a multi-user workstation or a user who gains foothold via a separate vulnerability - connects to the X server and issues XKB protocol requests redefining key types with non-canonical, oversized shift levels. CheckKeyTypes() fails to clamp the values, the subsequent write overflows a fixed-size stack buffer, and the attacker overwrites the saved return address to gain code execution in the X server process; if Xorg is running as root (still common on traditional Linux desktops and some thin-client/VNC setups), this yields root. No public exploit identified at time of analysis, but the upstream commit diff plus prior CVE-2025-26597 research materially lower the development cost.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 05, 2026

Local privilege escalation in X.Org X server and Xwayland stems from an incomplete fix for CVE-2025-26597, where CheckKeyTypes() fails to clamp non-canonical key types to XkbMaxShiftLevel, enabling stack-based buffer overflows. Authenticated local users on Red Hat Enterprise Linux 6 through 10 can crash the display server or, when X runs as root, escalate to root privileges. No public exploit identified at time of analysis, though the upstream commit reveals the vulnerable code path and the prior CVE-2025-26597 has known exploitation history.

RemediationAI

Apply Patch available per vendor advisory: install the Red Hat erratum referenced at https://access.redhat.com/security/cve/CVE-2026-50258 for your RHEL major version (6 through 10), or rebuild xorg-server / xwayland with upstream commit 543e108516428fc8c3bea91d6563ad266f9a801e applied as documented in https://lists.x.org/archives/xorg-announce/2026-June/003702.html. Restart the display manager (or reboot) so the patched binary is loaded - running X sessions continue to use the vulnerable in-memory image until restart. If patching must be deferred, prefer running Xwayland under a Wayland compositor rather than the legacy Xorg server (eliminates the root-privilege escalation path while retaining X client compatibility, at the cost of breaking X11-specific features such as some screen-capture tools and legacy input grabs), and on servers where Xorg must run as root, restrict local logins to trusted users and disable XKB extension reconfiguration over untrusted X displays (note this will break international keyboard layout switching for affected users).

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The X.Org X server and Xwayland implement the XKB (X Keyboard Extension) protocol, which allows clients to define custom keyboard layouts including key types and shift levels. Internally, the server allocates several stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups to hold per-group key state. The CheckKeyTypes() validation routine, intended to enforce canonical bounds, omits a clamp on shift levels for non-canonical key types - a CWE-121 (Stack-based Buffer Overflow) condition. A malicious local client sending crafted XKB requests with excessive shift levels writes past these fixed-size stack buffers. The CPE data shows Red Hat Enterprise Linux 6, 7, 8, 9, and 10 all package the affected xorg-x11-server / xwayland components. The patch landed upstream as commit 543e108516428fc8c3bea91d6563ad266f9a801e and was announced on the xorg-announce mailing list in June 2026.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Zero Day Initiative Advisories

ZDI-26-392 X.Org Server Xkb Key Types Stack-based Buffer Overflow Privilege Escalation Vulnerability Jun 2026

Executive ViewAI

Why It Matters

CVE-2026-50258 is a local privilege escalation vulnerability in X.Org X server and Xwayland affecting Red Hat Enterprise Linux 6 through 10, allowing authenticated local users to escalate to root privileges when the display server runs with elevated permissions. No vendor patch is currently available, requiring immediate implementation of compensating controls to prevent unauthorized system compromise. Organizations with RHEL deployments where X operates as root face elevated risk of complete system takeover by local users.

Business Impact: High
Compensating Controls

Configure X.Org X server and Xwayland to run with minimal privileges (not as root); restrict local terminal and SSH access to authorized users only; deploy and enforce SELinux or AppArmor profiles to block privilege escalation paths; implement logging and alerting for privilege escalation attempts; subscribe to Red Hat security advisories for patch notifications; evaluate Wayland as alternative display server where operationally feasible.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-50258 ADVISORY https://vuldb.com/vuln/368893 REF https://access.redhat.com/errata/RHSA-2026:26562 REF https://access.redhat.com/errata/RHSA-2026:26566 REF https://access.redhat.com/errata/RHSA-2026:26590 REF https://access.redhat.com/errata/RHSA-2026:26610 REF https://access.redhat.com/errata/RHSA-2026:26709 REF https://access.redhat.com/errata/RHSA-2026:28923 REF https://access.redhat.com/errata/RHSA-2026:29844 REF https://access.redhat.com/errata/RHSA-2026:36083 REF https://access.redhat.com/errata/RHSA-2026:36085 REF https://access.redhat.com/errata/RHSA-2026:36086 REF https://access.redhat.com/errata/RHSA-2026:36087 REF https://access.redhat.com/errata/RHSA-2026:36632 REF https://access.redhat.com/errata/RHSA-2026:36633 REF https://access.redhat.com/errata/RHSA-2026:36634 REF https://access.redhat.com/errata/RHSA-2026:36768 REF https://access.redhat.com/errata/RHSA-2026:36791 REF https://access.redhat.com/errata/RHSA-2026:36792 REF https://access.redhat.com/errata/RHSA-2026:36798 REF https://access.redhat.com/errata/RHSA-2026:38502 REF https://access.redhat.com/errata/RHSA-2026:38810 REF https://access.redhat.com/errata/RHSA-2026:46377 REF https://access.redhat.com/errata/RHSA-2026:46382 REF https://access.redhat.com/errata/RHSA-2026:46385 REF https://access.redhat.com/errata/RHSA-2026:46392 REF https://access.redhat.com/errata/RHSA-2026:46456 REF https://access.redhat.com/errata/RHSA-2026:46460 REF https://access.redhat.com/errata/RHSA-2026:46473 REF https://access.redhat.com/errata/RHSA-2026:49519 REF https://access.redhat.com/security/cve/CVE-2026-50258 REF https://bugzilla.redhat.com/show_bug.cgi?id=2485383 REF https://gitlab.freedesktop.org/xorg/xserver/-/commit/543e108516428fc8c3bea91d6563ad266f9a801e REF https://lists.x.org/archives/xorg-announce/2026-June/003702.html REF https://redhat.atlassian.net/browse/PSIRTSUPT-16950 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50258.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy