Skip to main content

X.Org X Server EUVDEUVD-2026-27343

| CVE-2026-34002 CRITICAL
Buffer Access with Incorrect Length Value (CWE-805)
2026-05-05 redhat
Buffer Overflow Denial Of Service Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat
Critical
Disputed · 9.1 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain X11 client access to server
  2. Delivery
    Send malformed XKB modifier-map request
  3. Exploit
    Trigger out-of-bounds read in XKB handling
  4. Execution
    Leak adjacent server memory or crash server
  5. Impact
    Information disclosure or denial of service

Vulnerability Assessment

Weakness
CWE
CWE-805
ASVS 5.0
V15 - Secure Coding and Architecture Buffer access bounds checking
Exploitation Conditions

Requires the attacker to be able to connect to the running X.Org X server as an X11 client and submit a malformed XKB (X Keyboard Extension) request that drives modifier-map handling out of bounds. Limiting factors: the attacker needs reachability to the X server - on default modern RHEL/SUSE installations the server does not listen on TCP, so this typically means a local user, an already-authorized X session, or a malicious/compromised X client rather than a remote unauthenticated network actor; impact is limited to information disclosure of server memory and denial of service (crash), with no integrity/code-execution impact indicated. Exploitation does not require user interaction.
Impact

Signals conflict and must be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:H, 9.1 Critical) implies trivial remote unauthenticated exploitation, but the description scopes the attacker to 'access to the X11 server' - i.e. an X11 client connection. On modern X.Org/RHEL deployments the server does not listen on TCP by default, so realistic exploitation is local or via an already-connected (malicious/compromised) X client rather than open network reach; the AV:N rating likely overstates remote exposure and should be verified against deployment mode. Counter-signals point to low real-world urgency: EPSS is 0.01% (2nd percentile), SSVC records Exploitation: none, Automatable: no, and Technical Impact: partial, and no exploit or PoC reference appears in the input. Against that, the vuln.today Decision label is act_now and a patch is available from the vendor, so this should be prioritized for patching rather than deferred. Net: a genuinely high-severity information-disclosure/DoS flaw in a widely deployed component that warrants prompt patching per the act_now label, but with no evidence of active or automatable exploitation and a real-world attack surface narrower than the AV:N score suggests.
Exploit ScenarioDerived

A local user or a malicious/compromised X11 client connects to the running X.Org server and sends a crafted XKB request that mishandles the modifier map, causing the server to read beyond the intended buffer. The attacker reads back leaked adjacent server memory (potentially sensitive data from other clients/sessions) or crashes the X server, denying service to the whole graphical session. No public exploit or PoC is identified in the available data, and the trigger beyond 'malformed XKB modifier-map request' is not detailed in the sources.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Oct 26, 2026

Out-of-bounds reads in the X.Org X server's XKB (X Keyboard Extension) modifier-map handling allow an authenticated X11 client to drive memory reads past the intended buffer, disclosing server memory or crashing the server for a denial of service. Affected deployments include the upstream X.Org X server and the Red Hat Enterprise Linux 6, 7, 8, 9 and 10 streams plus SUSE Linux Enterprise packages covered by the SUSE-SU-2026 advisories. Exposure is gated by reachability: on default modern RHEL and SUSE installations the X server does not listen on TCP, so realistic attackers are local users, already-authorized X sessions, or malicious/compromised X clients rather than a remote unauthenticated network actor; no integrity or code-execution impact is indicated. EPSS is 0.01% (2nd percentile) and SSVC records no exploitation, so no public exploit has been identified at time of analysis, while vendor errata are already published and the provider priority label is act_now.

Earlier versions of this analysis (1)
v1 May 05, 2026 - 16:31 CVSS 6.1

Out-of-bounds read in X.Org X Server XKB modifier map handling allows local authenticated attackers to read sensitive memory or crash the server by sending malformed X11 requests. The vulnerability affects RHEL 6 through 10 and requires local access with user-level privileges; exploitation results in information disclosure or denial of service.

RemediationAI

Vendor patches are available: Red Hat addresses the flaw through RHSA-2026:20547, RHSA-2026:20555 and RHSA-2026:20557 (tracked in Bugzilla 2451112 and the Red Hat CVE page), and SUSE through SUSE-SU-2026:1328, 1329, 1330, 1331, 1332, 1333, 1335 and 21211; apply the updated xorg-x11-server packages from the advisory matching your distribution release and stream, since exact fixed build numbers are not enumerated in the available data. Because the assessed exploitation precondition is the ability to connect to the running X server as a client, exposure tracks who can reach the server: keep the X server in its default state of not listening on TCP, and limit which local users and applications can attach to a given display, recognising that this narrows but does not eliminate the attack surface for an already-authorized session or a compromised client - only the vendor update removes the out-of-bounds read. Restarting the X server after updating is required for the fix to take effect, which terminates existing graphical sessions and should be scheduled accordingly.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The X Keyboard Extension (XKB) is the X11 protocol extension that carries keyboard geometry, keymaps and modifier mappings between clients and the server; modifier-map requests describe which keysyms and virtual modifiers are bound to which real modifiers. CWE-805 (Buffer Access with Incorrect Length Value) describes the root-cause class here: a length or count field in the XKB modifier-map request is not validated against the size of the destination buffer, so the server walks past the end of its allocation. Because this is a read primitive inside the X server process, the direct consequences are disclosure of adjacent server memory and, where the over-read crosses an unmapped page, a server crash terminating every session it serves; there is no write primitive and therefore no code-execution path is implied. CPE data attributes the flaw to Red Hat Enterprise Linux 6, 7, 8, 9 and 10 (multiple parallel streams for 8 and 9), and SUSE shipped parallel fixes, indicating the defect is in shared upstream X.Org X server code inherited across those distributions. Notably the public description and the NVD-published vector frame this as network-reachable (AV:N, PR:N), whereas the assessed vector is AV:L/AC:L/PR:L/UI:N, reflecting that the attacker must actually be able to connect to the running X server as a client and submit the malformed request; the trigger specifics beyond malformed XKB modifier-map handling are not described in the available sources.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 7.1 HIGH

Needs an authorized/local X11 client connection to the server (AV:L, PR:L); malformed request triggers OOB read giving memory disclosure (C:H) and crash (A:H), with no integrity impact (I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Red Hat 6.1 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Updated
Oct 26, 2026 - 19:29 vuln.today
v2 - CVSS changed
Severity Changed
Oct 26, 2026 - 19:23 NVD
MEDIUM CRITICAL
CVSS changed
Oct 26, 2026 - 19:23 NVD
6.1 (MEDIUM) 9.1 (CRITICAL)

DescriptionNVD

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.

Zero Day Initiative Advisories

ZDI-26-336 X.Org Server CheckKeyActions Out-Of-Bounds Read Information Disclosure Vulnerability Jun 2026

Executive ViewAI

Why It Matters

A critical memory handling flaw in the X.Org X server's keyboard extension (CVE-2026-34002) could allow an authenticated local user or malicious X client to read sensitive server memory or crash the graphical session, causing a denial of service. This affects all Red Hat Enterprise Linux streams (6-10) and SUSE Linux Enterprise deployments that run the X server, potentially disrupting desktop and workstation environments across the organization. Leadership should care because exploitation requires only local access, and a successful attack can leak credentials or bring down critical user sessions, though no active exploitation or public exploit has been observed.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Prevalence
High
X.Org X server ships across all supported RHEL and SUSE Linux releases
Social Media
4
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)NVD

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-805 – Buffer Access with Incorrect Length Value

View all
CVE-2024-24851 HIGH POC
7.5
CVE-2020-14509 CRITICAL
9.8
CVE-2021-3581 HIGH
8.8
CVE-2025-30651 HIGH
8.7
CVE-2026-1837 HIGH
8.7
CVE-2025-20315 HIGH
8.6
CVE-2025-58774 HIGH
8.3
CVE-2026-1767 HIGH
8.1

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Affected
Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE Affected
Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34002 ADVISORY https://vuldb.com/vuln/361196 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1328/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1329/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1330/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1331/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1332/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1333/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1335/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21211/ REF https://access.redhat.com/errata/RHSA-2026:20547 REF https://access.redhat.com/errata/RHSA-2026:20555 REF https://access.redhat.com/errata/RHSA-2026:20557 REF https://access.redhat.com/errata/RHSA-2026:20558 REF https://access.redhat.com/errata/RHSA-2026:20560 REF https://access.redhat.com/errata/RHSA-2026:20561 REF https://access.redhat.com/errata/RHSA-2026:20562 REF https://access.redhat.com/errata/RHSA-2026:20563 REF https://access.redhat.com/errata/RHSA-2026:20575 REF https://access.redhat.com/errata/RHSA-2026:20576 REF https://access.redhat.com/errata/RHSA-2026:20590 REF https://access.redhat.com/errata/RHSA-2026:21699 REF https://access.redhat.com/errata/RHSA-2026:21712 REF https://access.redhat.com/errata/RHSA-2026:21715 REF https://access.redhat.com/errata/RHSA-2026:21716 REF https://access.redhat.com/errata/RHSA-2026:21718 REF https://access.redhat.com/errata/RHSA-2026:21741 REF https://access.redhat.com/errata/RHSA-2026:21742 REF https://access.redhat.com/errata/RHSA-2026:22424 REF https://access.redhat.com/errata/RHSA-2026:22456 REF https://access.redhat.com/errata/RHSA-2026:23254 REF https://access.redhat.com/errata/RHSA-2026:23255 REF https://access.redhat.com/errata/RHSA-2026:23496 REF https://access.redhat.com/errata/RHSA-2026:24341 REF https://access.redhat.com/security/cve/CVE-2026-34002 REF https://bugzilla.redhat.com/show_bug.cgi?id=2451112

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy