CVE-2026-34002: Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling
A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.
Other sources
Out-of-bounds Read vulnerability in the XKB modifier map request handling of the X.Org X server. The function CheckModifierMap() processes wire data in a loop but does not sufficiently verify that the remaining bytes are within the bounds of the client request. As a result, the total number of keys processed can exceed the actual data supplied by the client, causing reads of uninitialized memory beyond the request buffer. An attacker with access to the X11 server can trigger this without user interaction, potentially disclosing memory and/or crashing the service.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34002?
CVE-2026-34002 is considered a medium severity vulnerability due to its potential for information disclosure and denial of service.
How do I fix CVE-2026-34002?
To fix CVE-2026-34002, upgrade to the patched version of the X.Org X server or xwayland as provided by your vendor.
What type of vulnerability is CVE-2026-34002?
CVE-2026-34002 is an out-of-bounds read vulnerability affecting the XKB modifier map handling in the X.Org X server.
Who is affected by CVE-2026-34002?
Any system running affected versions of the X.Org X server or xwayland can potentially be impacted by CVE-2026-34002.
What are the potential impacts of CVE-2026-34002?
The potential impacts of CVE-2026-34002 include unauthorized information disclosure or a denial of service condition.