--- id: CVE-2026-34001 title: >- Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption summary: >- A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this witho… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cvssSource: cna cwe: - CWE-825 vendor: Red Hat product: xorg-x11-server-Xwayland affected: - xorg-x11-server-Xwayland (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-04-23T00:00:00+00:00' published: '2026-04-23' updated: '2026-11-04' sourceUpdated: '2026-11-04T22:25:11.821Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-34001' references: - url: 'https://access.redhat.com/errata/RHSA-2026:10739' label: 'RHSA-2026:10739' - url: 'https://access.redhat.com/errata/RHSA-2026:11352' label: 'RHSA-2026:11352' - url: 'https://access.redhat.com/errata/RHSA-2026:11369' label: 'RHSA-2026:11369' - url: 'https://access.redhat.com/errata/RHSA-2026:11388' label: 'RHSA-2026:11388' - url: 'https://access.redhat.com/errata/RHSA-2026:11656' label: 'RHSA-2026:11656' - url: 'https://access.redhat.com/errata/RHSA-2026:11692' label: 'RHSA-2026:11692' - url: 'https://access.redhat.com/errata/RHSA-2026:13414' label: 'RHSA-2026:13414' - url: 'https://access.redhat.com/errata/RHSA-2026:19125' label: 'RHSA-2026:19125' - url: 'https://access.redhat.com/errata/RHSA-2026:19342' label: 'RHSA-2026:19342' - url: 'https://access.redhat.com/errata/RHSA-2026:19343' label: 'RHSA-2026:19343' - url: 'https://access.redhat.com/errata/RHSA-2026:19344' label: 'RHSA-2026:19344' - url: 'https://access.redhat.com/errata/RHSA-2026:20547' label: 'RHSA-2026:20547' - url: 'https://access.redhat.com/errata/RHSA-2026:20555' label: 'RHSA-2026:20555' - url: 'https://access.redhat.com/errata/RHSA-2026:20557' label: 'RHSA-2026:20557' - url: 'https://access.redhat.com/errata/RHSA-2026:20558' label: 'RHSA-2026:20558' - url: 'https://access.redhat.com/errata/RHSA-2026:20560' label: 'RHSA-2026:20560' - url: 'https://access.redhat.com/errata/RHSA-2026:20561' label: 'RHSA-2026:20561' - url: 'https://access.redhat.com/errata/RHSA-2026:20562' label: 'RHSA-2026:20562' - url: 'https://access.redhat.com/errata/RHSA-2026:20563' label: 'RHSA-2026:20563' - url: 'https://access.redhat.com/errata/RHSA-2026:20575' label: 'RHSA-2026:20575' - url: 'https://access.redhat.com/errata/RHSA-2026:20576' label: 'RHSA-2026:20576' - url: 'https://access.redhat.com/errata/RHSA-2026:20590' label: 'RHSA-2026:20590' - url: 'https://access.redhat.com/errata/RHSA-2026:21699' label: 'RHSA-2026:21699' - url: 'https://access.redhat.com/errata/RHSA-2026:21712' label: 'RHSA-2026:21712' - url: 'https://access.redhat.com/errata/RHSA-2026:21715' label: 'RHSA-2026:21715' - url: 'https://access.redhat.com/errata/RHSA-2026:21716' label: 'RHSA-2026:21716' - url: 'https://access.redhat.com/errata/RHSA-2026:21718' label: 'RHSA-2026:21718' - url: 'https://access.redhat.com/errata/RHSA-2026:21741' label: 'RHSA-2026:21741' - url: 'https://access.redhat.com/errata/RHSA-2026:21742' label: 'RHSA-2026:21742' - url: 'https://access.redhat.com/errata/RHSA-2026:22424' label: 'RHSA-2026:22424' - url: 'https://access.redhat.com/errata/RHSA-2026:22456' label: 'RHSA-2026:22456' - url: 'https://access.redhat.com/errata/RHSA-2026:23254' label: 'RHSA-2026:23254' - url: 'https://access.redhat.com/errata/RHSA-2026:23255' label: 'RHSA-2026:23255' - url: 'https://access.redhat.com/errata/RHSA-2026:23496' label: 'RHSA-2026:23496' - url: 'https://access.redhat.com/errata/RHSA-2026:24341' label: 'RHSA-2026:24341' - url: 'https://access.redhat.com/security/cve/CVE-2026-34001' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2451109' label: RHBZ#2451109 tags: - cve.org epss: 0.00264 epssPercentile: 0.18423 ingestedAt: '2026-11-05T21:36:00.644Z' --- ## Overview A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system. ## Affected - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ### Workarounds To mitigate this issue, restrict access to the X11 server to trusted users and networks. If the X.Org X server is not required, consider disabling or uninstalling it. For environments where the X server is essential, running X applications within a sandboxed environment can help reduce the attack surface.