--- id: CVE-2026-34002 title: >- Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling summary: >- A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, w… severity: medium cvss: 6.1 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L' cvssSource: cna cwe: - CWE-805 vendor: Red Hat product: xorg-x11-server-Xwayland affected: - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server-Xwayland (all versions) - xorg-x11-server - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) - tigervnc (all versions) - xorg-x11-server (all versions) - xorg-x11-server-Xwayland (all versions) ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-05-06T14:27:00.488000Z' published: '2026-05-05' updated: '2026-11-05' sourceUpdated: '2026-11-05T20:29:02.857Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-34002' references: - url: 'https://access.redhat.com/errata/RHSA-2026:20547' label: 'RHSA-2026:20547' - url: 'https://access.redhat.com/errata/RHSA-2026:20555' label: 'RHSA-2026:20555' - url: 'https://access.redhat.com/errata/RHSA-2026:20557' label: 'RHSA-2026:20557' - url: 'https://access.redhat.com/errata/RHSA-2026:20558' label: 'RHSA-2026:20558' - url: 'https://access.redhat.com/errata/RHSA-2026:20560' label: 'RHSA-2026:20560' - url: 'https://access.redhat.com/errata/RHSA-2026:20561' label: 'RHSA-2026:20561' - url: 'https://access.redhat.com/errata/RHSA-2026:20562' label: 'RHSA-2026:20562' - url: 'https://access.redhat.com/errata/RHSA-2026:20563' label: 'RHSA-2026:20563' - url: 'https://access.redhat.com/errata/RHSA-2026:20575' label: 'RHSA-2026:20575' - url: 'https://access.redhat.com/errata/RHSA-2026:20576' label: 'RHSA-2026:20576' - url: 'https://access.redhat.com/errata/RHSA-2026:20590' label: 'RHSA-2026:20590' - url: 'https://access.redhat.com/errata/RHSA-2026:21699' label: 'RHSA-2026:21699' - url: 'https://access.redhat.com/errata/RHSA-2026:21712' label: 'RHSA-2026:21712' - url: 'https://access.redhat.com/errata/RHSA-2026:21715' label: 'RHSA-2026:21715' - url: 'https://access.redhat.com/errata/RHSA-2026:21716' label: 'RHSA-2026:21716' - url: 'https://access.redhat.com/errata/RHSA-2026:21718' label: 'RHSA-2026:21718' - url: 'https://access.redhat.com/errata/RHSA-2026:21741' label: 'RHSA-2026:21741' - url: 'https://access.redhat.com/errata/RHSA-2026:21742' label: 'RHSA-2026:21742' - url: 'https://access.redhat.com/errata/RHSA-2026:22424' label: 'RHSA-2026:22424' - url: 'https://access.redhat.com/errata/RHSA-2026:22456' label: 'RHSA-2026:22456' - url: 'https://access.redhat.com/errata/RHSA-2026:23254' label: 'RHSA-2026:23254' - url: 'https://access.redhat.com/errata/RHSA-2026:23255' label: 'RHSA-2026:23255' - url: 'https://access.redhat.com/errata/RHSA-2026:23496' label: 'RHSA-2026:23496' - url: 'https://access.redhat.com/errata/RHSA-2026:24341' label: 'RHSA-2026:24341' - url: 'https://access.redhat.com/security/cve/CVE-2026-34002' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2451112' label: RHBZ#2451112 tags: - cve.org epss: 0.00489 epssPercentile: 0.42228 ingestedAt: '2026-11-05T22:38:31.790Z' --- ## Overview A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service. ## Affected - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `xorg-x11-server` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` - `tigervnc (all versions)` - `xorg-x11-server (all versions)` - `xorg-x11-server-Xwayland (all versions)` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ### Workarounds To mitigate this vulnerability, restrict access to the X11 server. If the X.Org X server is not required on a system, consider disabling or uninstalling it. For systems where the X server is necessary, ensure that access is limited to trusted users and networks. This can involve configuring `xhost` or implementing firewall rules to restrict connections to the X server. Any changes to X server configuration or service status may require a restart of the X server for the mitigation to take effect, which will impact active graphical sessions.