It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1789 advisory.

    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X     server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font     alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is     1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the     undersized stack buffer without further checks. This may be used to crash the server, or for privilege     escalation if the X server runs as root. (CVE-2026-50256)

    A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that     sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would     connect to the X server to set up a fence and await that fence, then a second X connection destroys the     fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if     the X server runs as root. (CVE-2026-50257)

    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple     stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-     canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and     trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash     the server, or for privilege escalation if the X server runs as root. (CVE-2026-50258)

    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks()     declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function     CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow.
    This may be used to crash the server, or for privilege escalation if the X server runs as root.
    (CVE-2026-50259)

    A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up     multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those     counters via a second client connection. This may be used to crash the server, or for privilege escalation     if the X server runs as root. (CVE-2026-50260)

    A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that     sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second     client connection while changing those counters. This may be used to crash the server, or for privilege     escalation if the X server runs as root. (CVE-2026-50261)

    Multiple issues have been found in the X server and Xwayland implementations published by X.Org for which     we are releasing security fixes for in xorg-server-21.1.23 and xwayland-24.1.12. (CVE-2026-50262)

    A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can     trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to     information disclosure. (CVE-2026-50263)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2026-1789)

high Nessus Plugin ID 319792

Version 1.5