{
  "threat_severity" : "Important",
  "public_date" : "2026-04-23T14:14:42Z",
  "bugzilla" : {
    "description" : "xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption",
    "id" : "2451109",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2451109"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-825",
  "details" : [ "A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.", "A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system." ],
  "statement" : "Important: This use-after-free vulnerability in the X.Org X server's XSYNC fence triggering logic can lead to a server crash and potential memory corruption. Exploitation requires an attacker to have access to the X11 server, typically limited to local users or trusted remote connections. Systems not running the X.Org X server are not affected.",
  "acknowledgement" : "Red Hat would like to thank Jan-Niklas Sohn (TrendAI Zero Day Initiative) for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-04-28T00:00:00Z",
    "advisory" : "RHSA-2026:11352",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.1",
    "package" : "xorg-x11-server-Xwayland-0:24.1.5-6.el10_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-05-19T00:00:00Z",
    "advisory" : "RHSA-2026:19125",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "xorg-x11-server-Xwayland-0:24.1.9-4.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20563",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "xorg-x11-server-Xwayland-0:24.1.5-6.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20590",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "xorg-x11-server-0:1.20.4-34.el7_9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-04-29T00:00:00Z",
    "advisory" : "RHSA-2026:11656",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "xorg-x11-server-Xwayland-0:21.1.3-20.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-04-29T00:00:00Z",
    "advisory" : "RHSA-2026:11692",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "xorg-x11-server-0:1.20.11-28.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-05-04T00:00:00Z",
    "advisory" : "RHSA-2026:13414",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "tigervnc-0:1.15.0-9.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21715",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "xorg-x11-server-0:1.20.10-4.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21715",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.4",
    "package" : "xorg-x11-server-0:1.20.10-4.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21716",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "xorg-x11-server-Xwayland-0:21.1.3-2.el8_6.6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21718",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "xorg-x11-server-0:1.20.11-7.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21716",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "xorg-x11-server-Xwayland-0:21.1.3-2.el8_6.6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21718",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "xorg-x11-server-0:1.20.11-7.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21716",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "xorg-x11-server-Xwayland-0:21.1.3-2.el8_6.6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21718",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "xorg-x11-server-0:1.20.11-7.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21712",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "xorg-x11-server-Xwayland-0:21.1.3-13.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21742",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "xorg-x11-server-0:1.20.11-18.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21712",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "xorg-x11-server-Xwayland-0:21.1.3-13.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21742",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "xorg-x11-server-0:1.20.11-18.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-04-27T00:00:00Z",
    "advisory" : "RHSA-2026:10739",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "tigervnc-0:1.15.0-6.el9_7.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-04-28T00:00:00Z",
    "advisory" : "RHSA-2026:11369",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "xorg-x11-server-Xwayland-0:23.2.7-6.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-04-28T00:00:00Z",
    "advisory" : "RHSA-2026:11388",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "xorg-x11-server-0:1.20.11-33.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-05-19T00:00:00Z",
    "advisory" : "RHSA-2026:19342",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "tigervnc-0:1.15.0-7.el9_8.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-05-19T00:00:00Z",
    "advisory" : "RHSA-2026:19343",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "xorg-x11-server-0:1.20.11-34.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-05-19T00:00:00Z",
    "advisory" : "RHSA-2026:19344",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "xorg-x11-server-Xwayland-0:24.1.9-4.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20562",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "xorg-x11-server-Xwayland-0:21.1.3-5.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21699",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "xorg-x11-server-0:1.20.11-13.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2026-05-28T00:00:00Z",
    "advisory" : "RHSA-2026:21741",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "tigervnc-0:1.11.0-22.el9_0.17"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20547",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "xorg-x11-server-Xwayland-0:21.1.3-10.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20557",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "xorg-x11-server-0:1.20.11-20.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20576",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "tigervnc-0:1.12.0-14.el9_2.14"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20555",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "xorg-x11-server-0:1.20.11-28.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20560",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "xorg-x11-server-Xwayland-0:22.1.9-8.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20575",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "tigervnc-0:1.13.1-8.el9_4.9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20558",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "xorg-x11-server-0:1.20.11-33.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20561",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "xorg-x11-server-Xwayland-0:23.2.7-6.el9_6"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Affected",
    "package_name" : "tigervnc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "xorg-x11-server",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "tigervnc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-34001\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34001" ],
  "name" : "CVE-2026-34001",
  "mitigation" : {
    "value" : "To mitigate this issue, restrict access to the X11 server to trusted users and networks. If the X.Org X server is not required, consider disabling or uninstalling it. For environments where the X server is essential, running X applications within a sandboxed environment can help reduce the attack surface.",
    "lang" : "en:us"
  },
  "csaw" : false
}