Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain authorized X11 connection
  2. Delivery
    Send crafted XKB compat-map request
  3. Exploit
    Trigger integer underflow in length
  4. Execution
    Out-of-bounds buffer read
  5. Impact
    Leak server memory or crash server (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-191
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
Exploitation Conditions

Exploitation requires an authorized connection to the X.Org X server (PR:L) and the ability to send XKB protocol requests that reach the compatibility-map handling code - i.e., the attacker must be a local user with an active display or a client permitted to talk to the display server. What limits exploitation: it is not remote-unauthenticated in default hardened setups because the X server ships with '-nolisten tcp' (no TCP listener) and X authorization cookies gate access, so a purely external network attacker generally cannot reach the vulnerable code unless remote X11/TCP has been deliberately enabled; on a single-user headless server with no running X session, the code path is not exposed at all. Risk rises on multi-user desktops, terminal/thin-client servers, or hosts where remote X11 forwarding or TCP listening has been turned on.
Impact

The signals are consistent and point to a real but non-urgent local/authorized-client bug rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H = 7.8) indicates an attacker needs local presence or an authorized X11 connection (PR:L) but no user interaction, and CISA SSVC scores Exploitation=none, Automatable=no, Technical Impact=total - matching the very low EPSS of 0.01% (2nd percentile). There is no KEV listing and no public exploit identified at time of analysis, so this is not a targeted-in-the-wild scenario. One caveat worth verifying: the CVSS vector claims full integrity impact (I:H), but the description characterizes the primary effect as a buffer READ overrun leading to DoS and memory-safety violations, which more naturally supports confidentiality (memory disclosure) and availability (crash) than arbitrary write/integrity - treat I:H as vendor-conservative until the code path is confirmed. Overall this is a patch-in-normal-cycle issue, higher priority on multi-user or remote-X11 hosts than on single-user headless servers.
Exploit ScenarioDerived

A logged-in local user (or a client reachable over an exposed X11 socket) opens a connection to the X server and issues crafted XKB requests that manipulate the compatibility map so an internal length value underflows. The server then reads past the buffer bounds, either crashing the display server and terminating all graphical sessions (DoS) or returning leaked server-process memory to the attacker's client. No user interaction is required and attack complexity is low, though the attacker must already have an authorized X11 connection; no public proof-of-concept is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Memory-disclosure and denial-of-service in the X.Org X server arises from an integer underflow (CWE-191) in the XKB compatibility map handling, which lets a client with local or remote X11 access trigger an out-of-bounds buffer read. Any attacker able to open a connection to the display server can crash it or read adjacent server memory, with Red Hat and SUSE rating the technical impact as total; no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile). This was reported by Red Hat and affects the X server shipped across Red Hat Enterprise Linux 6 through 10.

RemediationAI

Patch available per vendor advisory: apply the updated xorg-x11-server packages from your distribution and restart the X session (or reboot). Red Hat provides fixes via errata RHSA-2026:10739, RHSA-2026:11352, and RHSA-2026:11369 (https://access.redhat.com/errata/RHSA-2026:10739); SUSE publishes fixes in SUSE-SU-2026:1328 through 1335 and SUSE-SU-2026:21211 (https://www.suse.com/support/update/SUSE-SU-2026:1328/). Exact fixed package versions are enumerated in those errata and should be pulled directly rather than guessed. If patching must be deferred, reduce exposure by restricting who can connect to the display server: keep X access authorization enabled (never run 'xhost +'), disable remote TCP listening on the X server (the '-nolisten tcp' default) so only local authorized clients can reach it, and on multi-user hosts limit local login/console access - the trade-off is that legitimate remote X11 or multi-seat use cases will break. Migrating GUI workloads to Wayland where feasible removes this X-server code path entirely, at the cost of application compatibility testing.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The X.Org Server is the reference implementation of the X11 display server that mediates between client applications and graphics/input hardware on most Linux and BSD desktops. The flaw lives in the XKB (X Keyboard Extension) subsystem, specifically the routines that parse and store compatibility maps (compat map) sent via XKB protocol requests. CWE-191 (integer underflow) indicates a size or count value is decremented below zero (or a subtraction wraps around on an unsigned type), producing a huge or invalid length that is then used as a bound for a read operation, causing the server to read past the end of an allocated buffer. Because a single X server process handles all connected clients with elevated access to input and framebuffer state, out-of-bounds reads in this code path can leak server-process memory to the malicious client or corrupt internal state enough to crash the server.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.1 HIGH

Requires an authorized local/X11 client connection (AV:L, PR:L, AC:L); a read overrun leaks server memory (C:H) and crashes the server (A:H) but does not clearly enable writes (I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Apr 28, 2026 - 20:30 nvd
Patch available
CVE Published
Apr 23, 2026 - 14:53 nvd
HIGH 7.8

DescriptionCVE.org

A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.

Zero Day Initiative Advisories

ZDI-26-333 X.Org Server XkbSetCompatMap Integer Underflow Privilege Escalation Vulnerability Jun 2026

Executive ViewAI

Why It Matters

The X.Org X server shipped across Red Hat Enterprise Linux versions 6 through 10 contains a memory-disclosure and denial-of-service vulnerability that allows any network client to connect to the display server and crash it or read sensitive memory. While real-world exploitation probability is negligible (0.01% EPSS), the widespread presence of this component in enterprise Linux infrastructure and availability of a vendor patch make this a critical but manageable remediation priority within 30 days.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Prevalence
High
X.Org server ships on most Linux desktops and RHEL 6-10 GUI hosts
Social Media
5
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Affected
Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-GCE Affected
Image SLES15-SP6-SAP Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-EC2 Affected
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-33999 ADVISORY https://vuldb.com/vuln/359150 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1328/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1329/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1330/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1331/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1332/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1333/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1335/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21211/ REF https://access.redhat.com/errata/RHSA-2026:10739 REF https://access.redhat.com/errata/RHSA-2026:11352 REF https://access.redhat.com/errata/RHSA-2026:11369 REF https://access.redhat.com/errata/RHSA-2026:11388 REF https://access.redhat.com/errata/RHSA-2026:11656 REF https://access.redhat.com/errata/RHSA-2026:11692 REF https://access.redhat.com/errata/RHSA-2026:13414 REF https://access.redhat.com/errata/RHSA-2026:19125 REF https://access.redhat.com/errata/RHSA-2026:19342 REF https://access.redhat.com/errata/RHSA-2026:19343 REF https://access.redhat.com/errata/RHSA-2026:19344 REF https://access.redhat.com/errata/RHSA-2026:20547 REF https://access.redhat.com/errata/RHSA-2026:20555 REF https://access.redhat.com/errata/RHSA-2026:20557 REF https://access.redhat.com/errata/RHSA-2026:20558 REF https://access.redhat.com/errata/RHSA-2026:20560 REF https://access.redhat.com/errata/RHSA-2026:20561 REF https://access.redhat.com/errata/RHSA-2026:20562 REF https://access.redhat.com/errata/RHSA-2026:20563 REF https://access.redhat.com/errata/RHSA-2026:20575 REF https://access.redhat.com/errata/RHSA-2026:20576 REF https://access.redhat.com/errata/RHSA-2026:20590 REF https://access.redhat.com/errata/RHSA-2026:21699 REF https://access.redhat.com/errata/RHSA-2026:21712 REF https://access.redhat.com/errata/RHSA-2026:21715 REF https://access.redhat.com/errata/RHSA-2026:21716 REF https://access.redhat.com/errata/RHSA-2026:21718 REF https://access.redhat.com/errata/RHSA-2026:21741 REF https://access.redhat.com/errata/RHSA-2026:21742 REF https://access.redhat.com/errata/RHSA-2026:22424 REF https://access.redhat.com/errata/RHSA-2026:22456 REF https://access.redhat.com/errata/RHSA-2026:23254 REF https://access.redhat.com/errata/RHSA-2026:23255 REF https://access.redhat.com/errata/RHSA-2026:23496 REF https://access.redhat.com/errata/RHSA-2026:24341 REF https://access.redhat.com/security/cve/CVE-2026-33999 REF https://bugzilla.redhat.com/show_bug.cgi?id=2451106 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33999.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy