X.Org Server font alias overflow allows local privilege escalation
Original title: ZDI-26-903: X.Org Server Font Alias Resolution Heap-based Buffer Overflow Privilege Escalation Vulnerability
ZDI rates CVE-2026-50256 at 7.8; attackers must already run low-privileged code.
Zero Day Initiative published ZDI-26-903 for a heap-based buffer overflow in X.Org Server font alias resolution. A local attacker who can already execute low-privileged code can escalate privileges. ZDI assigned CVSS 7.8 and CVE-2026-50256. Affected versions and a fix are not stated.
- Advisory identifier is ZDI-26-903.
- The flaw is a heap-based buffer overflow during font alias resolution.
- Exploitation requires existing low-privileged code execution.
- ZDI assigned a CVSS rating of 7.8.
Impact: local privilege escalation
| Product | Affected |
|---|---|
| X.Org Server | — |
- CVEs
- CVE-2026-50256
- Vendors
- X.Org
- Products
- X.Org Server
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50256 | A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland | 7.8 | <1% |
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of X. Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.