CVE-2026-34000
Modified Modified - Updated After Analysis
Out-of-Bounds Read in X.Org X Server

Publication date: 2026-05-05

Last updated on: 2026-06-08

Assigner: Red Hat, Inc.

Description
A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-05
Last Modified
2026-06-08
Generated
2026-06-16
AI Q&A
2026-05-05
EPSS Evaluated
2026-06-14
NVD
CVE-2026-34000
EUVD
EUVD-2026-27341
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
redhat enterprise_linux 7.0
redhat enterprise_linux 6.0
redhat enterprise_linux 8.0
x.org x_server *
redhat enterprise_linux 9.0
redhat enterprise_linux 10.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-34000 is an out-of-bounds read vulnerability in the X.Org X server's XKB geometry processing. It specifically affects the CheckSetGeom() and XkbAddGeomKeyAlias functions. The flaw occurs because bounds checking only validates the first key name of each alias entry, leaving the second name unchecked. This allows an attacker to read uninitialized or out-of-bounds memory when processing a specially crafted request.

An attacker with access to the X11 server, either locally or remotely through forwarded sessions, can exploit this vulnerability without any user interaction.

Compliance Impact

This vulnerability allows an attacker to read uninitialized or out-of-bounds memory, potentially leading to the disclosure of sensitive memory contents. Such unauthorized disclosure of information could impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access.

However, the provided information does not explicitly discuss compliance implications or specific impacts on regulatory standards.

Mitigation Strategies

To mitigate this vulnerability, it is important to restrict access to the X.Org X server, as the flaw can be exploited by attackers with local or remote access to the X11 server.

  • Limit or disable remote forwarded X11 sessions to prevent remote exploitation.
  • Apply any available patches or updates from your vendor addressing this specific vulnerability.
  • Consider restarting the X server after applying patches to ensure the fix is active.

These steps help reduce the risk of information disclosure or denial of service caused by this out-of-bounds read vulnerability.

Impact Analysis

Exploitation of this vulnerability can lead to the disclosure of sensitive memory contents, potentially exposing confidential information.

Additionally, it can cause a denial-of-service condition by crashing the X.Org X server, disrupting normal system operations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34000. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart