A stack-based buffer overflow exists in the font alias resolution component of the X.Org X server and Xwayland due to a size mismatch between the server's allocated stack buffer (256 bytes) and the libXfont2 library's maximum font alias name length (1024 bytes). When a font alias name length exceeds 256 bytes but is less than 1024 bytes, the server copies the name into an undersized stack buffer without adequate bounds checking, leading to a buffer overflow. This vulnerability (CVE-2026-50256) may be exploited to crash the X server or escalate privileges if the server runs as root. Red Hat has issued security advisories and patches for affected versions of Red Hat Enterprise Linux 8 and 10 to fix this and other related vulnerabilities in the xorg-x11-server and xorg-x11-server-Xwayland packages.

Successful exploitation of this vulnerability can cause a denial of service by crashing the X server or potentially allow privilege escalation if the X server is running with root privileges. The CVSS v3.1 base score is 7.8, indicating a high severity impact with high confidentiality, integrity, and availability impacts. No known exploits in the wild have been reported at this time.

Red Hat has released official security updates that address this vulnerability in the xorg-x11-server and xorg-x11-server-Xwayland packages for Red Hat Enterprise Linux 8 and 10. Users should apply the updates as detailed in Red Hat Advisory RHSA-2026:26562 for RHEL 8 and RHSA-2026:26566 for RHEL 10. Patch availability is confirmed, and applying these updates will remediate the vulnerability. Refer to https://access.redhat.com/articles/11258 for update instructions.