Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-05-05T14:01:46 xorg: xwayland: X.Org X server: Information disclosure or Denial of Service via out-of-bounds read in XKB modifier map handling 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L CWE-805

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.

Moderate: This out-of-bounds read vulnerability in the X.Org X server's XKB modifier map handling could lead to information disclosure or service crashes. An attacker with access to the X11 server can trigger this without user interaction. This affects systems running the X.Org X server. Red Hat would like to thank Jan-Niklas Sohn (TrendAI Zero Day Initiative) for reporting this issue. To mitigate this vulnerability, restrict access to the X11 server. If the X.Org X server is not required on a system, consider disabling or uninstalling it. For systems where the X server is necessary, ensure that access is limited to trusted users and networks. This can involve configuring `xhost` or implementing firewall rules to restrict connections to the X server. Any changes to X server configuration or service status may require a restart of the X server for the mitigation to take effect, which will impact active graphical sessions. Red Hat Enterprise Linux 10 Affected xorg-x11-server-Xwayland Red Hat Enterprise Linux 6 Affected tigervnc Red Hat Enterprise Linux 6 Out of support scope xorg-x11-server Red Hat Enterprise Linux 7 Affected tigervnc Red Hat Enterprise Linux 7 Affected xorg-x11-server Red Hat Enterprise Linux 8 Affected tigervnc Red Hat Enterprise Linux 8 Affected xorg-x11-server Red Hat Enterprise Linux 8 Affected xorg-x11-server-Xwayland Red Hat Enterprise Linux 9 Affected tigervnc Red Hat Enterprise Linux 9 Affected xorg-x11-server Red Hat Enterprise Linux 9 Affected xorg-x11-server-Xwayland https://www.cve.org/CVERecord?id=CVE-2026-34002 https://nvd.nist.gov/vuln/detail/CVE-2026-34002