CVE WatchJul 27, 2026

CVE-2026-50256

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's

CVSS

7.8

High

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Jun 5, 2026 · Last modified: Jul 27, 2026 · CWE-121

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-032026-07-31

Technical description

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-678229.8 CRI

—

——0Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow.17h CVE-2026-157227.5 HIG

40.7%

——12A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.1d CVE-2026-438327.5 HIG

3.8%

——1Full details and mitigation steps are currently restricted and will be published at a later date.16h CVE-2026-438317.5 HIG

3.8%

——1Full details and mitigation steps are currently restricted and will be published at a later date.16h CVE-2026-438297.5 HIG

3.8%

——1Full details and mitigation steps are currently restricted and will be published at a later date.16h CVE-2026-105358.4 HIG

2.3%

——1IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.1d