{"id":"CVE-2026-34001","title":"Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption","summary":"A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this witho…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-825"],"vendor":"Red Hat","product":"xorg-x11-server-Xwayland","affected":["xorg-x11-server-Xwayland (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server-Xwayland (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server-Xwayland (all versions)","xorg-x11-server (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","tigervnc (all versions)","xorg-x11-server (all versions)","xorg-x11-server-Xwayland (all versions)","tigervnc (all versions)","xorg-x11-server"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-04-23T00:00:00+00:00"},"published":"2026-04-23","updated":"2026-11-04","sourceUpdated":"2026-11-04T22:25:11.821Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-34001","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:10739","label":"RHSA-2026:10739"},{"url":"https://access.redhat.com/errata/RHSA-2026:11352","label":"RHSA-2026:11352"},{"url":"https://access.redhat.com/errata/RHSA-2026:11369","label":"RHSA-2026:11369"},{"url":"https://access.redhat.com/errata/RHSA-2026:11388","label":"RHSA-2026:11388"},{"url":"https://access.redhat.com/errata/RHSA-2026:11656","label":"RHSA-2026:11656"},{"url":"https://access.redhat.com/errata/RHSA-2026:11692","label":"RHSA-2026:11692"},{"url":"https://access.redhat.com/errata/RHSA-2026:13414","label":"RHSA-2026:13414"},{"url":"https://access.redhat.com/errata/RHSA-2026:19125","label":"RHSA-2026:19125"},{"url":"https://access.redhat.com/errata/RHSA-2026:19342","label":"RHSA-2026:19342"},{"url":"https://access.redhat.com/errata/RHSA-2026:19343","label":"RHSA-2026:19343"},{"url":"https://access.redhat.com/errata/RHSA-2026:19344","label":"RHSA-2026:19344"},{"url":"https://access.redhat.com/errata/RHSA-2026:20547","label":"RHSA-2026:20547"},{"url":"https://access.redhat.com/errata/RHSA-2026:20555","label":"RHSA-2026:20555"},{"url":"https://access.redhat.com/errata/RHSA-2026:20557","label":"RHSA-2026:20557"},{"url":"https://access.redhat.com/errata/RHSA-2026:20558","label":"RHSA-2026:20558"},{"url":"https://access.redhat.com/errata/RHSA-2026:20560","label":"RHSA-2026:20560"},{"url":"https://access.redhat.com/errata/RHSA-2026:20561","label":"RHSA-2026:20561"},{"url":"https://access.redhat.com/errata/RHSA-2026:20562","label":"RHSA-2026:20562"},{"url":"https://access.redhat.com/errata/RHSA-2026:20563","label":"RHSA-2026:20563"},{"url":"https://access.redhat.com/errata/RHSA-2026:20575","label":"RHSA-2026:20575"},{"url":"https://access.redhat.com/errata/RHSA-2026:20576","label":"RHSA-2026:20576"},{"url":"https://access.redhat.com/errata/RHSA-2026:20590","label":"RHSA-2026:20590"},{"url":"https://access.redhat.com/errata/RHSA-2026:21699","label":"RHSA-2026:21699"},{"url":"https://access.redhat.com/errata/RHSA-2026:21712","label":"RHSA-2026:21712"},{"url":"https://access.redhat.com/errata/RHSA-2026:21715","label":"RHSA-2026:21715"},{"url":"https://access.redhat.com/errata/RHSA-2026:21716","label":"RHSA-2026:21716"},{"url":"https://access.redhat.com/errata/RHSA-2026:21718","label":"RHSA-2026:21718"},{"url":"https://access.redhat.com/errata/RHSA-2026:21741","label":"RHSA-2026:21741"},{"url":"https://access.redhat.com/errata/RHSA-2026:21742","label":"RHSA-2026:21742"},{"url":"https://access.redhat.com/errata/RHSA-2026:22424","label":"RHSA-2026:22424"},{"url":"https://access.redhat.com/errata/RHSA-2026:22456","label":"RHSA-2026:22456"},{"url":"https://access.redhat.com/errata/RHSA-2026:23254","label":"RHSA-2026:23254"},{"url":"https://access.redhat.com/errata/RHSA-2026:23255","label":"RHSA-2026:23255"},{"url":"https://access.redhat.com/errata/RHSA-2026:23496","label":"RHSA-2026:23496"},{"url":"https://access.redhat.com/errata/RHSA-2026:24341","label":"RHSA-2026:24341"},{"url":"https://access.redhat.com/security/cve/CVE-2026-34001"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451109","label":"RHBZ#2451109"}],"tags":["cve.org"],"epss":0.00264,"epssPercentile":0.18423,"ingestedAt":"2026-11-05T21:36:00.644Z","slug":"CVE-2026-34001","body":"## Overview\n\nA flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.\n\n## Affected\n\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `xorg-x11-server (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server (all versions)`\n- `xorg-x11-server-Xwayland (all versions)`\n- `tigervnc (all versions)`\n- `xorg-x11-server`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this issue, restrict access to the X11 server to trusted users and networks. If the X.Org X server is not required, consider disabling or uninstalling it. For environments where the X server is essential, running X applications within a sandboxed environment can help reduce the attack surface.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}