- CVE-2026-50256: increase XLFDMAXFONTNAMELEN to 1024 and bound-check resolved font-alias names before copying into the pattern buffers, preventing a stack overflow during alias resolution (bundled xorg-server) - CVE-2026-50257, CVE-2026-50260: fix use-after-free when destroying sync fences (miSyncDestroyFence) and counters (FreeCounter) whose trigger list is shared across an Await group (bundled xorg-server) - CVE-2026-50258: reject XKB key types whose numLevels exceeds XkbMaxShiftLevel in CheckKeyTypes, preventing a stack overflow in XkbKeyTypesForCoreSymbols (bundled xorg-server) - CVE-2026-50259: clamp nMaps to the mapWidths buffer size in CheckKeyTypes so an XkbSetMap resize request cannot overflow the stack buffer (bundled xorg-server) - CVE-2026-50261: restart trigger-list iteration in SyncChangeCounter after a trigger fires, preventing a use-after-free of freed trigger nodes (bundled xorg-server) - CVE-2026-50262: enforce an exact request size in glx ChangeDrawableAttributes, fixing a reversed length check that allowed an out-of-bounds read/write (bundled xorg-server) - CVE-2026-50263: re-fetch the screen-saver screen private after CheckScreenPrivate in CreateSaverWindow, preventing a use-after-free (bundled xorg-server)