Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Connect as X11 client to X server
  2. Exploit
    Send crafted XKB SetGeometry request
  3. Execution
    Trigger OOB read in CheckSetGeom/XkbAddGeomKeyAlias
  4. Impact
    Disclose server memory or crash X server

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The attacker must be able to establish an X11 client connection to a running X.Org X server - by default this is a local Unix-domain socket, and remote exploitation is possible only when the server is started with TCP network listening enabled, which is non-default on modern distributions. With such a connection the attacker sends crafted XKB geometry (SetGeometry) requests that reach CheckSetGeom() and XkbAddGeomKeyAlias(); no user interaction is needed. Limiting factors: exploitation is gated by access to the X server (normally requiring X authorization such as an xauth cookie), remote reach requires the non-default TCP listener, and the impact is bounded to memory disclosure (uninitialized/out-of-bounds read) or a server crash - there is no integrity/code-write primitive described.
Impact

The signals here diverge sharply and should be weighed together rather than on CVSS alone. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:H = 9.1 Critical) and the vuln.today 'act_now' priority label argue for urgency, but the exploitation-intensity signals do not corroborate widespread danger: EPSS is only 0.01% (2nd percentile), the CISA SSVC framework records Exploitation: none, Automatable: no, and Technical Impact: partial, and there is no CISA KEV listing. That combination indicates a genuinely high-severity memory-safety defect that is NOT currently being exploited at scale - a real patch-priority item on multi-user and remote-X hosts, not evidence of active campaigns. One tension to verify: the supplied vector is PR:N (unauthenticated), yet the description requires 'a connection to the X11 server,' and X11 clients normally need authorization (xauth/MIT-MAGIC-COOKIE); treat the unauthenticated framing with caution. A second caveat: the vector is AV:N, but modern X.Org builds listen only on a local Unix socket by default and disable TCP, so remote exploitation is realistic only where network X listening is explicitly enabled - verify deployment mode. Net: prioritize patching per vendor guidance, especially on shared/remote-display systems, but the real-world exploitation likelihood is presently low.
Exploit ScenarioDerived

A local user or an authorized X11 client opens a connection to a running X.Org X server and sends crafted XKB geometry requests that reach CheckSetGeom() and XkbAddGeomKeyAlias(), triggering an out-of-bounds read. The attacker either harvests disclosed uninitialized/adjacent server memory or crashes the X server for denial of service. No public exploit identified at time of analysis; exploitation needs no user interaction but does require the ability to connect as an X11 client.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Oct 26, 2026

An out-of-bounds read in the X.Org X server's XKB geometry handling, specifically in CheckSetGeom() and XkbAddGeomKeyAlias(), allows an attacker who can open an X11 client connection to the server to read uninitialized or out-of-bounds memory or to crash the X server. Affected builds are those shipped in Red Hat Enterprise Linux 6 through 10 and the SUSE products covered by the SUSE-SU-2026:1328 through 1335 and SUSE-SU-2026:21211 updates; the supplied CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/A:H), while our assessment lowers privileges required to low because a connection must ordinarily clear X authorization such as an xauth cookie before reaching the vulnerable code. No public exploit code was identified at time of analysis (EPSS 0.01%, 2nd percentile; SSVC exploitation: none), but the vuln.today decision label is act_now, so the divergent signals should be weighed together rather than on the base score alone.

Earlier versions of this analysis (1)
v1 May 05, 2026 - 16:31 CVSS 6.1

Out-of-bounds read in X.Org X server XKB geometry processing allows local or remote attackers with X11 server access to disclose sensitive memory contents or cause denial of service by crashing the server. The vulnerability exists in CheckSetGeom() and XkbAddGeomKeyAlias functions and requires low privileges but no user interaction. No public exploit code or active exploitation has been identified at time of analysis.

RemediationAI

No exact fixed version number is stated in the supplied data, but patch status is 'available from vendor', so remediation means applying the vendor erratum for your platform: on Red Hat Enterprise Linux 6 through 10 install the xorg-x11-server update referenced by RHSA-2026:19342, RHSA-2026:20547 or RHSA-2026:20555 as appropriate, and on SUSE apply the updates in SUSE-SU-2026:1328, 1329, 1330, 1331, 1332, 1333, 1335 or 21211 matching your product. Cross-check package versions against the Red Hat CVE page and Bugzilla 2451107 before rollout. Where immediate patching is not possible, the practical compensating controls follow directly from how the flaw is reached: keep the X server's TCP listener disabled (the default -nolisten tcp behaviour on modern distributions), accepting that this blocks legitimate remote X11 clients, and enforce X authorization with xauth cookies so that untrusted local users cannot open a client connection to another user's server, at the cost of extra administration for shared or kiosk-style displays. Neither control addresses the parsing flaw itself, and the vendor updates remain the complete fix.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The X Keyboard Extension (XKB) lets X11 clients describe keyboard layouts, including geometry, and the server parses those client-supplied structures before storing them. In this case crafted XKB geometry requests reaching CheckSetGeom() and XkbAddGeomKeyAlias() result in reads of uninitialized or out-of-bounds memory, a classic CWE-125 out-of-bounds read, which can surface as disclosure of server memory contents in geometry replies or as a crash that takes down the X server. The trigger conditions beyond the named functions are not described in the available sources. Reachability matters: X11 clients normally connect over a local Unix-domain socket and must satisfy X authorization, and remote reach exists only when the server is started with TCP listening enabled, which is non-default on modern distributions. The impact described is bounded to memory disclosure and denial of service; no integrity or code-execution primitive is described in the available data.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 8.1 HIGH

X11 clients normally require authorization, so PR:L not PR:N; AV:N retained because remote X listening is possible; C:H (memory disclosure) and A:H (server crash), I:N as an OOB read gives no write.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Red Hat 6.1 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Updated
Oct 26, 2026 - 19:30 vuln.today
v2 - CVSS changed
Severity Changed
Oct 26, 2026 - 19:23 NVD
MEDIUM CRITICAL
CVSS changed
Oct 26, 2026 - 19:23 NVD
6.1 (MEDIUM) 9.1 (CRITICAL)

DescriptionNVD

A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the CheckSetGeom() and XkbAddGeomKeyAlias functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.

Zero Day Initiative Advisories

ZDI-26-334 X.Org Server CheckSetGeom Out-Of-Bounds Read Information Disclosure Vulnerability Jun 2026

Executive ViewAI

Why It Matters

CVE-2026-34000 is a critical out-of-bounds read in the X.Org X server shipped with Red Hat Enterprise Linux 6 through 10 and certain SUSE products, enabling an attacker with an X11 connection to read sensitive memory or crash the server. While exploitation requires prior authorization and no public exploit code exists, the high impact and broad enterprise footprint make this a priority for immediate remediation to prevent potential data leakage or service downtime.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Prevalence
High
X.Org X server ships across all major Linux distributions and desktops
Social Media
4
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)NVD

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Affected
Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE Affected
Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34000 ADVISORY https://vuldb.com/vuln/361197 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1328/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1329/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1330/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1331/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1332/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1333/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1335/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21211/ REF https://access.redhat.com/errata/RHSA-2026:19342 REF https://access.redhat.com/errata/RHSA-2026:20547 REF https://access.redhat.com/errata/RHSA-2026:20555 REF https://access.redhat.com/errata/RHSA-2026:20557 REF https://access.redhat.com/errata/RHSA-2026:20558 REF https://access.redhat.com/errata/RHSA-2026:20560 REF https://access.redhat.com/errata/RHSA-2026:20561 REF https://access.redhat.com/errata/RHSA-2026:20562 REF https://access.redhat.com/errata/RHSA-2026:20563 REF https://access.redhat.com/errata/RHSA-2026:20575 REF https://access.redhat.com/errata/RHSA-2026:20576 REF https://access.redhat.com/errata/RHSA-2026:20590 REF https://access.redhat.com/errata/RHSA-2026:21699 REF https://access.redhat.com/errata/RHSA-2026:21712 REF https://access.redhat.com/errata/RHSA-2026:21715 REF https://access.redhat.com/errata/RHSA-2026:21716 REF https://access.redhat.com/errata/RHSA-2026:21718 REF https://access.redhat.com/errata/RHSA-2026:21741 REF https://access.redhat.com/errata/RHSA-2026:21742 REF https://access.redhat.com/errata/RHSA-2026:22424 REF https://access.redhat.com/errata/RHSA-2026:22456 REF https://access.redhat.com/errata/RHSA-2026:23254 REF https://access.redhat.com/errata/RHSA-2026:23255 REF https://access.redhat.com/errata/RHSA-2026:23496 REF https://access.redhat.com/errata/RHSA-2026:24341 REF https://access.redhat.com/security/cve/CVE-2026-34000 REF https://bugzilla.redhat.com/show_bug.cgi?id=2451107

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy