LiveActive security incident?Get immediate response
CVE Record

CVE-2026-34000: Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.

A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.

MediumCVSS 6.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-34000 affects the X.Org X server components used by Red Hat X11, Xwayland, and TigerVNC packages. A user or system able to connect to the X11 server could trigger memory disclosure or crash the graphical server. Business urgency is moderate, highest for shared Linux desktops, VDI, remote GUI, and legacy extended-support systems.

Executive priority

Treat as a scheduled security update with targeted urgency. It is not a known exploited emergency, but it can expose memory or disrupt graphical sessions on systems where untrusted users can reach X11.

Technical view

The flaw is a CWE-125 out-of-bounds read in XKB geometry processing, involving CheckSetGeom() and XkbAddGeomKeyAlias. Red Hat rates it medium with CVSS 6.1. Exploitation requires a connection to the X11 server, low privileges, and no user interaction. Impact is high confidentiality exposure and low availability impact; integrity is not indicated.

Likely exposure

Exposure is most likely on Red Hat systems running affected xorg-x11-server, xorg-x11-server-Xwayland, or tigervnc packages, especially RHEL 6/7 ELS, RHEL 8 update streams, and RHEL 10 EUS listed in the source bundle.

Exploitation context

The source bundle does not indicate active exploitation, and KEV status is false. Practical risk depends on who can connect to the X11 server locally or remotely. Systems exposing remote GUI access or multi-user graphical sessions deserve closer review.

Researcher notes

CVSS is local, but the description states exploitation is possible locally or remotely with an X11 server connection. Available sources name affected Red Hat package streams and advisories, but the supplied data does not provide exact fixed versions or proof-of-concept status.

Mitigation direction

  • Apply the relevant Red Hat security advisory for each affected product stream.
  • Prioritize shared desktops, VDI hosts, and remote GUI servers.
  • Restrict X11 and VNC access to trusted users and networks.
  • Check vendor guidance for fixed package versions and reboot requirements.
  • Retire or isolate unsupported graphical Linux systems where updates are unavailable.

Validation and detection

  • Inventory installed xorg-x11-server, xorg-x11-server-Xwayland, and tigervnc packages.
  • Map systems to the affected Red Hat product streams listed in the advisory.
  • Confirm whether applicable RHSA updates have been applied.
  • Review which hosts allow local or remote X11 server connections.
  • Verify graphical services restart cleanly after remediation.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-125: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-34000 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
1ADP providers
28Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.1CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L1.84.2redhat

Vulnerability scoring details

Base CVSS 3.1 score

6.1Medium
CVSS 3.1 vector shape for CVE-2026-34000Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. Source timelineredhat

    Reported to Red Hat.

  3. Source timelineredhat

    Made public.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Red HatRed Hat Enterprise Linux 10.0 Extended Update Supportxorg-x11-server-Xwayland, 0:24.1.5-6.el10_0affected
Red HatRed Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONtigervnc, 0:1.1.0-25.el6_10.16affected
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Supportxorg-x11-server, 0:1.20.4-34.el7_9affected
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Supporttigervnc, 0:1.8.0-36.el7_9.4affected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportxorg-x11-server, 0:1.20.10-4.el8_4affected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supporttigervnc, 0:1.11.0-8.el8_4.15affected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onxorg-x11-server, 0:1.20.10-4.el8_4affected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Ontigervnc, 0:1.11.0-8.el8_4.15affected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportxorg-x11-server-Xwayland, 0:21.1.3-2.el8_6.6affected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportxorg-x11-server, 0:1.20.11-7.el8_6affected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supporttigervnc, 0:1.12.0-6.el8_6.17affected
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Ontigervnc, 0:1.12.0-6.el8_6.17affected
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Servicexorg-x11-server-Xwayland, 0:21.1.3-2.el8_6.6affected
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Servicexorg-x11-server, 0:1.20.11-7.el8_6affected
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutionsxorg-x11-server-Xwayland, 0:21.1.3-2.el8_6.6affected
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutionsxorg-x11-server, 0:1.20.11-7.el8_6affected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Servicexorg-x11-server-Xwayland, 0:21.1.3-13.el8_8affected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Servicexorg-x11-server, 0:1.20.11-18.el8_8affected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Servicetigervnc, 0:1.12.0-15.el8_8.17affected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutionsxorg-x11-server-Xwayland, 0:21.1.3-13.el8_8affected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutionsxorg-x11-server, 0:1.20.11-18.el8_8affected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutionstigervnc, 0:1.12.0-15.el8_8.17affected
Red HatRed Hat Enterprise Linux 9tigervnc, 0:1.15.0-7.el9_8.1affected
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutionsxorg-x11-server-Xwayland, 0:21.1.3-5.el9_0affected
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutionsxorg-x11-server, 0:1.20.11-13.el9_0affected
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutionstigervnc, 0:1.11.0-22.el9_0.17affected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutionsxorg-x11-server-Xwayland, 0:21.1.3-10.el9_2affected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutionsxorg-x11-server, 0:1.20.11-20.el9_2affected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutionstigervnc, 0:1.12.0-14.el9_2.14affected
Red HatRed Hat Enterprise Linux 9.4 Extended Update Supportxorg-x11-server, 0:1.20.11-28.el9_4affected
Weakness

CWE details

CWE-125

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-125 · source CWE mapping

Out-of-bounds Read

Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs