CVE-2026-34000
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A flaw was found in the X.Org X server that allows for out-of-bounds memory read in XKB geometry processing. An attacker can exploit this vulnerability to read uninitialized memory or out-of-bounds memory, potentially leading to memory disclosure or server crashes.
Risk Assessment
This vulnerability poses a risk of sensitive data disclosure or disruption of the X11 server's operation, which could affect service availability within the organization.
Recommendation
It is recommended to update the X.Org X server to the latest version to mitigate this vulnerability and to monitor server logs for potential attack attempts.
Other vulnerabilities in X.Org X server
See all- CVE-2026-93516Medium
A use-after-free caused by lack of lifecycle management when adding or removing XInput master devices exists in X.org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit this to crash the X server or potentially execute code in the X server context.
- CVE-2026-93515Medium
A use-after-free in present_clear_window_notifies() in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be exploited by malicious X clients to crash the server or potentially execute code in the X server context.
- CVE-2017-10971High
In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events.
- CVE-2026-93536Medium
A use-after-free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to crash the X server or potentially execute code.
- CVE-2026-93524Medium
A buffer overread in CheckKeySyms() exists in X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit it to leak small amounts of information from X server memory or potentially crash the X server.
- CVE-2026-93523High
A heap buffer overflow in X.Org X Server before 21.1.15 and XWayland before 24.1.14 is triggered by an XIPassiveUngrabDevice request with an out-of-range modifier value. An authenticated X client could exploit this to crash the X server or potentially execute code in the server context.
- CVE-2026-93522High
A heap buffer overflow caused by mismatched size usage in the CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14. Authenticated X clients could use it to crash the server or potentially execute code in the X server context.
- CVE-2026-93521High
A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14. Authenticated X clients could use it to crash the server or execute code within the X server context.
- CVE-2026-93520High
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange exists in X.org X server before 2.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.
- CVE-2026-93519High
A buffer overflow when handling pointer barriers in the XFIXES extension exists in X.Org X server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.
Original NVD description (English source)
A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS