- CVE-2026-50256: increase XLFDMAXFONTNAMELEN and add bounds checks in doListFontsAndAliases/doListFontsWithInfo to prevent stack buffer overflow via long fonts.alias targets - CVE-2026-50257: fix use-after-free in miSyncDestroyFence by using safe list iteration and null-checking pTrigger before dereferencing - CVE-2026-50258: reject XkbSetMap key types with numLevels exceeding XkbMaxShiftLevel to prevent stack buffer overflow in XkbKeyTypesForCoreSymbols - CVE-2026-50259: clamp nMaps to XkbMaxLegalKeyCode+1 in CheckKeyTypes to prevent stack buffer overflow when XkbSetMapResizeTypes wraps - CVE-2026-50260: fix use-after-free in FreeCounter by using safe list iteration, advancing list head before callback, and NULL-ing out shared trigger pointers in FreeAwait - CVE-2026-50261: restart trigger list iteration in SyncChangeCounter after TriggerFired to avoid dereferencing freed sibling-trigger nodes - CVE-2026-50262: fix reversed length check in GLX ChangeDrawableAttributes by using REQUEST_FIXED_SIZE to prevent out-of-bounds read/write - CVE-2026-50263: re-fetch screen private after CheckScreenPrivate in CreateSaverWindow to avoid use-after-free on saver-window replacement