{"id":"CVE-2026-33999","title":"Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling","summary":"A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead t…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-191"],"vendor":"Red Hat","product":"xorg-x11-server-Xwayland","affected":["xorg-x11-server-Xwayland (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server-Xwayland (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","tigervnc (all versions)","xorg-x11-server"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-04-24T03:55:33.895310Z"},"published":"2026-04-23","updated":"2026-11-04","sourceUpdated":"2026-11-04T22:25:11.396Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-33999","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:10739","label":"RHSA-2026:10739"},{"url":"https://access.redhat.com/errata/RHSA-2026:11352","label":"RHSA-2026:11352"},{"url":"https://access.redhat.com/errata/RHSA-2026:11369","label":"RHSA-2026:11369"},{"url":"https://access.redhat.com/errata/RHSA-2026:11388","label":"RHSA-2026:11388"},{"url":"https://access.redhat.com/errata/RHSA-2026:11656","label":"RHSA-2026:11656"},{"url":"https://access.redhat.com/errata/RHSA-2026:11692","label":"RHSA-2026:11692"},{"url":"https://access.redhat.com/errata/RHSA-2026:13414","label":"RHSA-2026:13414"},{"url":"https://access.redhat.com/errata/RHSA-2026:19125","label":"RHSA-2026:19125"},{"url":"https://access.redhat.com/errata/RHSA-2026:19342","label":"RHSA-2026:19342"},{"url":"https://access.redhat.com/errata/RHSA-2026:19343","label":"RHSA-2026:19343"},{"url":"https://access.redhat.com/errata/RHSA-2026:19344","label":"RHSA-2026:19344"},{"url":"https://access.redhat.com/errata/RHSA-2026:20547","label":"RHSA-2026:20547"},{"url":"https://access.redhat.com/errata/RHSA-2026:20555","label":"RHSA-2026:20555"},{"url":"https://access.redhat.com/errata/RHSA-2026:20557","label":"RHSA-2026:20557"},{"url":"https://access.redhat.com/errata/RHSA-2026:20558","label":"RHSA-2026:20558"},{"url":"https://access.redhat.com/errata/RHSA-2026:20560","label":"RHSA-2026:20560"},{"url":"https://access.redhat.com/errata/RHSA-2026:20561","label":"RHSA-2026:20561"},{"url":"https://access.redhat.com/errata/RHSA-2026:20562","label":"RHSA-2026:20562"},{"url":"https://access.redhat.com/errata/RHSA-2026:20563","label":"RHSA-2026:20563"},{"url":"https://access.redhat.com/errata/RHSA-2026:20575","label":"RHSA-2026:20575"},{"url":"https://access.redhat.com/errata/RHSA-2026:20576","label":"RHSA-2026:20576"},{"url":"https://access.redhat.com/errata/RHSA-2026:20590","label":"RHSA-2026:20590"},{"url":"https://access.redhat.com/errata/RHSA-2026:21699","label":"RHSA-2026:21699"},{"url":"https://access.redhat.com/errata/RHSA-2026:21712","label":"RHSA-2026:21712"},{"url":"https://access.redhat.com/errata/RHSA-2026:21715","label":"RHSA-2026:21715"},{"url":"https://access.redhat.com/errata/RHSA-2026:21716","label":"RHSA-2026:21716"},{"url":"https://access.redhat.com/errata/RHSA-2026:21718","label":"RHSA-2026:21718"},{"url":"https://access.redhat.com/errata/RHSA-2026:21741","label":"RHSA-2026:21741"},{"url":"https://access.redhat.com/errata/RHSA-2026:21742","label":"RHSA-2026:21742"},{"url":"https://access.redhat.com/errata/RHSA-2026:22424","label":"RHSA-2026:22424"},{"url":"https://access.redhat.com/errata/RHSA-2026:22456","label":"RHSA-2026:22456"},{"url":"https://access.redhat.com/errata/RHSA-2026:23254","label":"RHSA-2026:23254"},{"url":"https://access.redhat.com/errata/RHSA-2026:23255","label":"RHSA-2026:23255"},{"url":"https://access.redhat.com/errata/RHSA-2026:23496","label":"RHSA-2026:23496"},{"url":"https://access.redhat.com/errata/RHSA-2026:24341","label":"RHSA-2026:24341"},{"url":"https://access.redhat.com/security/cve/CVE-2026-33999"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451106","label":"RHBZ#2451106"}],"tags":["cve.org"],"epss":0.0038,"epssPercentile":0.32191,"ingestedAt":"2026-11-05T21:36:00.645Z","slug":"CVE-2026-33999","body":"## Overview\n\nA flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.\n\n## Affected\n\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this issue, restrict access to the X11 server. For remote access, disable X11 forwarding in SSH configurations if not required. Edit `/etc/ssh/sshd_config` and set `X11Forwarding no`. After modifying the configuration, restart the `sshd` service using `systemctl restart sshd`. Disabling X11 forwarding may impact remote graphical applications.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}