CVE-2026-50259 is a stack-based buffer overflow vulnerability in the X.Org X server and Xwayland, specifically in the _XkbSetMapChecks() function. The function declares a fixed-size stack buffer mapWidths[256], which is indexed by a client-controlled key type index via the helper function CheckKeyTypes(), allowing an attacker to overflow the buffer. This can cause denial of service by crashing the server or privilege escalation if the server runs as root. The vulnerability affects Red Hat Enterprise Linux versions 8 (>=8.0.0 <8.10.2), 9 (>=9.0.0 <9.8.2), and 10 (>=10.0.0 <10.2). Red Hat has issued security advisories and updates that fix this issue along with other related vulnerabilities in the xorg-x11-server and xorg-x11-server-Xwayland packages.

Successful exploitation of this vulnerability may allow an attacker to crash the X server, causing denial of service, or escalate privileges if the X server is running with root privileges. The CVSS 3.1 base score is 7.8 (High), reflecting high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Red Hat has released official security updates that address this vulnerability in the xorg-x11-server and xorg-x11-server-Xwayland packages for affected Red Hat Enterprise Linux versions. Users should apply the updates as detailed in the Red Hat advisories RHSA-2026:26562 and RHSA-2026:26566. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are required beyond applying these official patches.