CVE-2026-34002: Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-05 · updated 2026-10-26
Weakness: CWE-805

Description

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.

Affected products

Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0, 10.0
xorg-x11-server: all versions

References

Get alerted when CVE-2026-34002 or the next vulnerability affects your stack