--- id: CVE-2026-33999 title: >- Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling summary: >- A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead t… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cvssSource: cna cwe: - CWE-191 vendor: Red Hat product: xorg-x11-server-Xwayland affected: - xorg-x11-server-Xwayland (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-04-24T03:55:33.895310Z' published: '2026-04-23' updated: '2026-11-04' sourceUpdated: '2026-11-04T22:25:11.396Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-33999' references: - url: 'https://access.redhat.com/errata/RHSA-2026:10739' label: 'RHSA-2026:10739' - url: 'https://access.redhat.com/errata/RHSA-2026:11352' label: 'RHSA-2026:11352' - url: 'https://access.redhat.com/errata/RHSA-2026:11369' label: 'RHSA-2026:11369' - url: 'https://access.redhat.com/errata/RHSA-2026:11388' label: 'RHSA-2026:11388' - url: 'https://access.redhat.com/errata/RHSA-2026:11656' label: 'RHSA-2026:11656' - url: 'https://access.redhat.com/errata/RHSA-2026:11692' label: 'RHSA-2026:11692' - url: 'https://access.redhat.com/errata/RHSA-2026:13414' label: 'RHSA-2026:13414' - url: 'https://access.redhat.com/errata/RHSA-2026:19125' label: 'RHSA-2026:19125' - url: 'https://access.redhat.com/errata/RHSA-2026:19342' label: 'RHSA-2026:19342' - url: 'https://access.redhat.com/errata/RHSA-2026:19343' label: 'RHSA-2026:19343' - url: 'https://access.redhat.com/errata/RHSA-2026:19344' label: 'RHSA-2026:19344' - url: 'https://access.redhat.com/errata/RHSA-2026:20547' label: 'RHSA-2026:20547' - url: 'https://access.redhat.com/errata/RHSA-2026:20555' label: 'RHSA-2026:20555' - url: 'https://access.redhat.com/errata/RHSA-2026:20557' label: 'RHSA-2026:20557' - url: 'https://access.redhat.com/errata/RHSA-2026:20558' label: 'RHSA-2026:20558' - url: 'https://access.redhat.com/errata/RHSA-2026:20560' label: 'RHSA-2026:20560' - url: 'https://access.redhat.com/errata/RHSA-2026:20561' label: 'RHSA-2026:20561' - url: 'https://access.redhat.com/errata/RHSA-2026:20562' label: 'RHSA-2026:20562' - url: 'https://access.redhat.com/errata/RHSA-2026:20563' label: 'RHSA-2026:20563' - url: 'https://access.redhat.com/errata/RHSA-2026:20575' label: 'RHSA-2026:20575' - url: 'https://access.redhat.com/errata/RHSA-2026:20576' label: 'RHSA-2026:20576' - url: 'https://access.redhat.com/errata/RHSA-2026:20590' label: 'RHSA-2026:20590' - url: 'https://access.redhat.com/errata/RHSA-2026:21699' label: 'RHSA-2026:21699' - url: 'https://access.redhat.com/errata/RHSA-2026:21712' label: 'RHSA-2026:21712' - url: 'https://access.redhat.com/errata/RHSA-2026:21715' label: 'RHSA-2026:21715' - url: 'https://access.redhat.com/errata/RHSA-2026:21716' label: 'RHSA-2026:21716' - url: 'https://access.redhat.com/errata/RHSA-2026:21718' label: 'RHSA-2026:21718' - url: 'https://access.redhat.com/errata/RHSA-2026:21741' label: 'RHSA-2026:21741' - url: 'https://access.redhat.com/errata/RHSA-2026:21742' label: 'RHSA-2026:21742' - url: 'https://access.redhat.com/errata/RHSA-2026:22424' label: 'RHSA-2026:22424' - url: 'https://access.redhat.com/errata/RHSA-2026:22456' label: 'RHSA-2026:22456' - url: 'https://access.redhat.com/errata/RHSA-2026:23254' label: 'RHSA-2026:23254' - url: 'https://access.redhat.com/errata/RHSA-2026:23255' label: 'RHSA-2026:23255' - url: 'https://access.redhat.com/errata/RHSA-2026:23496' label: 'RHSA-2026:23496' - url: 'https://access.redhat.com/errata/RHSA-2026:24341' label: 'RHSA-2026:24341' - url: 'https://access.redhat.com/security/cve/CVE-2026-33999' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2451106' label: RHBZ#2451106 tags: - cve.org epss: 0.0038 epssPercentile: 0.32191 ingestedAt: '2026-11-05T21:36:00.645Z' --- ## Overview A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts. ## Affected - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ### Workarounds To mitigate this issue, restrict access to the X11 server. For remote access, disable X11 forwarding in SSH configurations if not required. Edit `/etc/ssh/sshd_config` and set `X11Forwarding no`. After modifying the configuration, restart the `sshd` service using `systemctl restart sshd`. Disabling X11 forwarding may impact remote graphical applications.