CVE-2026-50256 is a stack-based buffer overflow vulnerability in the X.Org X server and Xwayland components of Red Hat Enterprise Linux 8 and 10. The issue stems from a discrepancy between the X server's allocated stack buffer size for font alias names (256 bytes) and the libXfont2 library's maximum font name length (1024 bytes). When a font alias name length is between 257 and 1023 bytes, the X server copies the name into the undersized buffer without proper bounds checking, causing a stack buffer overflow. This vulnerability can lead to denial of service (server crash) or privilege escalation if exploited on a system where the X server runs as root. Red Hat has issued security advisories RHSA-2026:26562 and RHSA-2026:26566 providing patches for affected versions. The CVSS v3.1 base score is 7.8, indicating high severity. The advisories also address multiple other vulnerabilities in the same components.

Successful exploitation of this vulnerability may cause the X server or Xwayland to crash, resulting in denial of service. More critically, if the X server is running with root privileges, an attacker could leverage this buffer overflow to escalate privileges on the affected system. The vulnerability affects both confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released official security updates that fix this vulnerability in the xorg-x11-server and xorg-x11-server-Xwayland packages for Red Hat Enterprise Linux 8 and 10. Users should apply these updates promptly to remediate the issue. Detailed update instructions are available in Red Hat advisory RHSA-2026:26562 for RHEL 8 and RHSA-2026:26566 for RHEL 10 at https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the vendor-provided patches.