X.Org Server XkbResizeKeySyms overflow allows local privilege escalation
Original title: ZDI-26-902: X.Org Server XkbResizeKeySyms Integer Overflow Privilege Escalation Vulnerability
ZDI rates CVE-2026-50258 at 7.8 and says low-privileged code is required first.
Zero Day Initiative published ZDI-26-902 for an integer overflow in X.Org Server’s XkbResizeKeySyms function. Local attackers who can already run low-privileged code can escalate privileges. ZDI assigned CVSS 7.8 and CVE-2026-50258. Affected versions and a fix are not stated.
- Advisory identifier is ZDI-26-902.
- The flaw is an integer overflow in XkbResizeKeySyms.
- Attackers need existing low-privileged code execution.
- ZDI assigned a CVSS rating of 7.8.
Impact: local privilege escalation
| Product | Affected |
|---|---|
| X.Org Server | — |
- CVEs
- CVE-2026-50258
- Vendors
- X.Org
- Products
- X.Org Server
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50258 | A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland | 7.8 | <1% |
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of X. Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.