--- id: CVE-2026-34000 title: >- Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing. summary: >- A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of… severity: medium cvss: 6.1 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L' cvssSource: cna cwe: - CWE-125 vendor: Red Hat product: xorg-x11-server-Xwayland affected: - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-05-05T18:51:27.642857Z' published: '2026-05-05' updated: '2026-11-05' sourceUpdated: '2026-11-05T20:28:58.071Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-34000' references: - url: 'https://access.redhat.com/errata/RHSA-2026:19342' label: 'RHSA-2026:19342' - url: 'https://access.redhat.com/errata/RHSA-2026:20547' label: 'RHSA-2026:20547' - url: 'https://access.redhat.com/errata/RHSA-2026:20555' label: 'RHSA-2026:20555' - url: 'https://access.redhat.com/errata/RHSA-2026:20557' label: 'RHSA-2026:20557' - url: 'https://access.redhat.com/errata/RHSA-2026:20558' label: 'RHSA-2026:20558' - url: 'https://access.redhat.com/errata/RHSA-2026:20560' label: 'RHSA-2026:20560' - url: 'https://access.redhat.com/errata/RHSA-2026:20561' label: 'RHSA-2026:20561' - url: 'https://access.redhat.com/errata/RHSA-2026:20562' label: 'RHSA-2026:20562' - url: 'https://access.redhat.com/errata/RHSA-2026:20563' label: 'RHSA-2026:20563' - url: 'https://access.redhat.com/errata/RHSA-2026:20575' label: 'RHSA-2026:20575' - url: 'https://access.redhat.com/errata/RHSA-2026:20576' label: 'RHSA-2026:20576' - url: 'https://access.redhat.com/errata/RHSA-2026:20590' label: 'RHSA-2026:20590' - url: 'https://access.redhat.com/errata/RHSA-2026:21699' label: 'RHSA-2026:21699' - url: 'https://access.redhat.com/errata/RHSA-2026:21712' label: 'RHSA-2026:21712' - url: 'https://access.redhat.com/errata/RHSA-2026:21715' label: 'RHSA-2026:21715' - url: 'https://access.redhat.com/errata/RHSA-2026:21716' label: 'RHSA-2026:21716' - url: 'https://access.redhat.com/errata/RHSA-2026:21718' label: 'RHSA-2026:21718' - url: 'https://access.redhat.com/errata/RHSA-2026:21741' label: 'RHSA-2026:21741' - url: 'https://access.redhat.com/errata/RHSA-2026:21742' label: 'RHSA-2026:21742' - url: 'https://access.redhat.com/errata/RHSA-2026:22424' label: 'RHSA-2026:22424' - url: 'https://access.redhat.com/errata/RHSA-2026:22456' label: 'RHSA-2026:22456' - url: 'https://access.redhat.com/errata/RHSA-2026:23254' label: 'RHSA-2026:23254' - url: 'https://access.redhat.com/errata/RHSA-2026:23255' label: 'RHSA-2026:23255' - url: 'https://access.redhat.com/errata/RHSA-2026:23496' label: 'RHSA-2026:23496' - url: 'https://access.redhat.com/errata/RHSA-2026:24341' label: 'RHSA-2026:24341' - url: 'https://access.redhat.com/security/cve/CVE-2026-34000' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2451107' label: RHBZ#2451107 tags: - cve.org epss: 0.00489 epssPercentile: 0.42228 ingestedAt: '2026-11-05T22:38:31.790Z' --- ## Overview A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server. ## Affected - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ### Workarounds To mitigate this vulnerability, restrict access to the X11 server. On systems where a graphical environment is not required, consider disabling the X server entirely by setting the default system target to multi-user mode. For systems requiring the X server, ensure that X11 forwarding is disabled in SSH configurations if not explicitly needed, and restrict direct X11 connections to trusted users and networks through firewall rules. If changes are made to SSH configuration, the `sshd` service must be restarted. If the default system target is changed, a system reboot is required.