Vulnerability-Lookup

RHSA-2026:11656

Vulnerability from csaf_redhat - Published: 2026-04-29 12:10 - Updated: 2026-04-29 18:27

Summary

Red Hat Security Advisory: xorg-x11-server-Xwayland security update

Severity

Important

Notes

Topic: An update for xorg-x11-server-Xwayland is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-33999

A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-191 - Integer Underflow (Wrap or Wraparound)

Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:11656

Workaround To mitigate this issue, restrict access to the X11 server. For remote access, disable X11 forwarding in SSH configurations if not required. Edit `/etc/ssh/sshd_config` and set `X11Forwarding no`. After modifying the configuration, restart the `sshd` service using `systemctl restart sshd`. Disabling X11 forwarding may impact remote graphical applications.

CVE-2026-34001

A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Workaround To mitigate this issue, restrict access to the X11 server to trusted users and networks. If the X.Org X server is not required, consider disabling or uninstalling it. For environments where the X server is essential, running X applications within a sandboxed environment can help reduce the attack surface.

CVE-2026-34003

A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-125 - Out-of-bounds Read

Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

References

URL

Category

	https://access.redhat.com/errata/RHSA-2026:11656	self
	https://access.redhat.com/security/updates/classi…	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2451106	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2451109	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2451113	external
	https://security.access.redhat.com/data/csaf/v2/a…	self
	https://access.redhat.com/security/cve/CVE-2026-33999	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2451106	external
	https://www.cve.org/CVERecord?id=CVE-2026-33999	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-33999	external
	https://access.redhat.com/security/cve/CVE-2026-34001	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2451109	external
	https://www.cve.org/CVERecord?id=CVE-2026-34001	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-34001	external
	https://access.redhat.com/security/cve/CVE-2026-34003	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2451113	external
	https://www.cve.org/CVERecord?id=CVE-2026-34003	external
	https://nvd.nist.gov/vuln/detail/CVE-2026-34003	external

Acknowledgments

TrendAI Zero Day Initiative Jan-Niklas Sohn

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for xorg-x11-server-Xwayland is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Xwayland is an X server for running X clients under Wayland.\n\nSecurity Fix(es):\n\n* xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)\n\n* xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)\n\n* xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:11656",
        "url": "https://access.redhat.com/errata/RHSA-2026:11656"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2451106",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451106"
      },
      {
        "category": "external",
        "summary": "2451109",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451109"
      },
      {
        "category": "external",
        "summary": "2451113",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451113"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11656.json"
      }
    ],
    "title": "Red Hat Security Advisory: xorg-x11-server-Xwayland security update",
    "tracking": {
      "current_release_date": "2026-04-29T18:27:43+00:00",
      "generator": {
        "date": "2026-04-29T18:27:43+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.7"
        }
      },
      "id": "RHSA-2026:11656",
      "initial_release_date": "2026-04-29T12:10:30+00:00",
      "revision_history": [
        {
          "date": "2026-04-29T12:10:30+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-29T12:10:30+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-29T18:27:43+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
                "product": {
                  "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
                  "product_id": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland@21.1.3-20.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
                "product": {
                  "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
                  "product_id": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland@21.1.3-20.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
                "product": {
                  "name": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
                  "product_id": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland-debugsource@21.1.3-20.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
                "product": {
                  "name": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
                  "product_id": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland-debuginfo@21.1.3-20.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
                "product": {
                  "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
                  "product_id": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland@21.1.3-20.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
                "product": {
                  "name": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
                  "product_id": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland-debugsource@21.1.3-20.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
                "product": {
                  "name": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
                  "product_id": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland-debuginfo@21.1.3-20.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
                "product": {
                  "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
                  "product_id": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland@21.1.3-20.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64",
                "product": {
                  "name": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64",
                  "product_id": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland-debugsource@21.1.3-20.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
                "product": {
                  "name": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
                  "product_id": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland-debuginfo@21.1.3-20.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
                "product": {
                  "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
                  "product_id": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland@21.1.3-20.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
                "product": {
                  "name": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
                  "product_id": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland-debugsource@21.1.3-20.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
                "product": {
                  "name": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
                  "product_id": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/xorg-x11-server-Xwayland-debuginfo@21.1.3-20.el8_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64"
        },
        "product_reference": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le"
        },
        "product_reference": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x"
        },
        "product_reference": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src"
        },
        "product_reference": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64"
        },
        "product_reference": "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64"
        },
        "product_reference": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le"
        },
        "product_reference": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x"
        },
        "product_reference": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64"
        },
        "product_reference": "xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64"
        },
        "product_reference": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le"
        },
        "product_reference": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x"
        },
        "product_reference": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
        },
        "product_reference": "xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Jan-Niklas Sohn"
          ],
          "organization": "TrendAI Zero Day Initiative"
        }
      ],
      "cve": "CVE-2026-33999",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "discovery_date": "2026-03-25T06:29:19.544586+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451106"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important integer underflow vulnerability exists in the X.Org X server\u0027s XKB compatibility map handling. This flaw allows an attacker with local or remote X11 server access to trigger a buffer read overrun, leading to memory-safety violations and potential denial of service. Red Hat Enterprise Linux systems utilizing the X.Org X server in graphical environments are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33999"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451106",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451106"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33999",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33999"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33999",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33999"
        }
      ],
      "release_date": "2026-04-23T14:11:12.550000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-29T12:10:30+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:11656"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict access to the X11 server. For remote access, disable X11 forwarding in SSH configurations if not required. Edit `/etc/ssh/sshd_config` and set `X11Forwarding no`. After modifying the configuration, restart the `sshd` service using `systemctl restart sshd`. Disabling X11 forwarding may impact remote graphical applications.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jan-Niklas Sohn"
          ],
          "organization": "TrendAI Zero Day Initiative"
        }
      ],
      "cve": "CVE-2026-34001",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-03-25T07:00:05.329048+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451109"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This use-after-free vulnerability in the X.Org X server\u0027s XSYNC fence triggering logic can lead to a server crash and potential memory corruption. Exploitation requires an attacker to have access to the X11 server, typically limited to local users or trusted remote connections. Systems not running the X.Org X server are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34001"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451109",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451109"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34001",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34001"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34001",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34001"
        }
      ],
      "release_date": "2026-04-23T14:14:42.224000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-29T12:10:30+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:11656"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict access to the X11 server to trusted users and networks. If the X.Org X server is not required, consider disabling or uninstalling it. For environments where the X server is essential, running X applications within a sandboxed environment can help reduce the attack surface.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jan-Niklas Sohn"
          ],
          "organization": "TrendAI Zero Day Initiative"
        }
      ],
      "cve": "CVE-2026-34003",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-03-25T07:19:13.949261+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451113"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the X.Org X server\u0027s XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important out-of-bounds memory access vulnerability exists in the X.Org X server\u0027s XKB key types request validation. This flaw could lead to information exposure or a server crash and requires a specially crafted request to trigger. Systems running a graphical environment are potentially affected, with higher impact outcomes possible in certain configurations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34003"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451113",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451113"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34003",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34003"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34003",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34003"
        }
      ],
      "release_date": "2026-04-23T14:18:00.653000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-29T12:10:30+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:11656"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debuginfo-0:21.1.3-20.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:xorg-x11-server-Xwayland-debugsource-0:21.1.3-20.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access"
    }
  ]
}

CVE-2026-34001 (GCVE-0-2026-34001)

Vulnerability from cvelistv5 – Published: 2026-04-23 14:54 – Updated: 2026-04-29 17:51

Title

Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption

Summary

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-825 - Expired Pointer Dereference

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/errata/RHSA-2026:10739	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11352	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11369	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11388	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11656	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11692	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2026-34001	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2451109	issue-trackingx_refsource_REDHAT

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

Unaffected: 0:24.1.5-6.el10_1 , < * (rpm)
cpe:/o:redhat:enterprise_linux:10.1

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:21.1.3-20.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.20.11-28.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.15.0-6.el9_7.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:23.2.7-6.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.20.11-33.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8

Date Public ?

2026-04-23 14:14

Credits

Red Hat would like to thank Jan-Niklas Sohn (TrendAI Zero Day Initiative) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34001",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-24T03:55:27.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:24.1.5-6.el10_1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:21.1.3-20.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.20.11-28.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.15.0-6.el9_7.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:23.2.7-6.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.20.11-33.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Jan-Niklas Sohn (TrendAI Zero Day Initiative) for reporting this issue."
        }
      ],
      "datePublic": "2026-04-23T14:14:42.224Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-825",
              "description": "Expired Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-29T17:51:30.610Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:10739",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:10739"
        },
        {
          "name": "RHSA-2026:11352",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11352"
        },
        {
          "name": "RHSA-2026:11369",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11369"
        },
        {
          "name": "RHSA-2026:11388",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11388"
        },
        {
          "name": "RHSA-2026:11656",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11656"
        },
        {
          "name": "RHSA-2026:11692",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11692"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-34001"
        },
        {
          "name": "RHBZ#2451109",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451109"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-25T07:00:05.329Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-04-23T14:14:42.224Z",
          "value": "Made public."
        }
      ],
      "title": "Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, restrict access to the X11 server to trusted users and networks. If the X.Org X server is not required, consider disabling or uninstalling it. For environments where the X server is essential, running X applications within a sandboxed environment can help reduce the attack surface."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-825: Expired Pointer Dereference"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-34001",
    "datePublished": "2026-04-23T14:54:00.333Z",
    "dateReserved": "2026-03-25T04:53:13.615Z",
    "dateUpdated": "2026-04-29T17:51:30.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33999 (GCVE-0-2026-33999)

Vulnerability from cvelistv5 – Published: 2026-04-23 14:53 – Updated: 2026-04-29 17:51

Title

Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling

Summary

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/errata/RHSA-2026:10739	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11352	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11369	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11388	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11656	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11692	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2026-33999	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2451106	issue-trackingx_refsource_REDHAT

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

Unaffected: 0:24.1.5-6.el10_1 , < * (rpm)
cpe:/o:redhat:enterprise_linux:10.1

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:21.1.3-20.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.20.11-28.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.15.0-6.el9_7.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:23.2.7-6.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.20.11-33.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8

Date Public ?

2026-04-23 14:11

Credits

Red Hat would like to thank Jan-Niklas Sohn (TrendAI Zero Day Initiative) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33999",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-24T03:55:33.895310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-24T13:37:08.875Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:24.1.5-6.el10_1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:21.1.3-20.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.20.11-28.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.15.0-6.el9_7.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:23.2.7-6.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.20.11-33.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Jan-Niklas Sohn (TrendAI Zero Day Initiative) for reporting this issue."
        }
      ],
      "datePublic": "2026-04-23T14:11:12.550Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-29T17:51:24.853Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:10739",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:10739"
        },
        {
          "name": "RHSA-2026:11352",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11352"
        },
        {
          "name": "RHSA-2026:11369",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11369"
        },
        {
          "name": "RHSA-2026:11388",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11388"
        },
        {
          "name": "RHSA-2026:11656",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11656"
        },
        {
          "name": "RHSA-2026:11692",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11692"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-33999"
        },
        {
          "name": "RHBZ#2451106",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451106"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-25T06:29:19.544Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-04-23T14:11:12.550Z",
          "value": "Made public."
        }
      ],
      "title": "Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, restrict access to the X11 server. For remote access, disable X11 forwarding in SSH configurations if not required. Edit `/etc/ssh/sshd_config` and set `X11Forwarding no`. After modifying the configuration, restart the `sshd` service using `systemctl restart sshd`. Disabling X11 forwarding may impact remote graphical applications."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-191: Integer Underflow (Wrap or Wraparound)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-33999",
    "datePublished": "2026-04-23T14:53:59.414Z",
    "dateReserved": "2026-03-25T04:53:13.614Z",
    "dateUpdated": "2026-04-29T17:51:24.853Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34003 (GCVE-0-2026-34003)

Vulnerability from cvelistv5 – Published: 2026-04-23 14:54 – Updated: 2026-04-29 17:51

Title

Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access

Summary

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-125 - Out-of-bounds Read

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/errata/RHSA-2026:10739	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11352	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11369	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11388	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11656	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2026:11692	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2026-34003	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2451113	issue-trackingx_refsource_REDHAT

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

Unaffected: 0:24.1.5-6.el10_1 , < * (rpm)
cpe:/o:redhat:enterprise_linux:10.1

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:21.1.3-20.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.20.11-28.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.15.0-6.el9_7.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:23.2.7-6.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.20.11-33.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8

Date Public ?

2026-04-23 14:18

Credits

Red Hat would like to thank Jan-Niklas Sohn (TrendAI Zero Day Initiative) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34003",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-24T03:55:31.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:24.1.5-6.el10_1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:21.1.3-20.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.20.11-28.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.15.0-6.el9_7.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:23.2.7-6.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.20.11-33.el9_7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Jan-Niklas Sohn (TrendAI Zero Day Initiative) for reporting this issue."
        }
      ],
      "datePublic": "2026-04-23T14:18:00.653Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the X.Org X server\u0027s XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-29T17:51:36.608Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:10739",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:10739"
        },
        {
          "name": "RHSA-2026:11352",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11352"
        },
        {
          "name": "RHSA-2026:11369",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11369"
        },
        {
          "name": "RHSA-2026:11388",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11388"
        },
        {
          "name": "RHSA-2026:11656",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11656"
        },
        {
          "name": "RHSA-2026:11692",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11692"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-34003"
        },
        {
          "name": "RHBZ#2451113",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451113"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-25T07:19:13.949Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-04-23T14:18:00.653Z",
          "value": "Made public."
        }
      ],
      "title": "Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-34003",
    "datePublished": "2026-04-23T14:54:05.479Z",
    "dateReserved": "2026-03-25T04:53:13.615Z",
    "dateUpdated": "2026-04-29T17:51:36.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:11656

CVE-2026-34001 (GCVE-0-2026-34001)

CVE-2026-33999 (GCVE-0-2026-33999)

CVE-2026-34003 (GCVE-0-2026-34003)

Tags

Sightings

Nomenclature