CVE-2026-34002

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.

X.Org X11 X server

Security Fix(es):

A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.(CVE-2026-33999)

(CVE-2026-34000)

A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.(CVE-2026-34001)

(CVE-2026-34002)

A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible.(CVE-2026-34003)

Xwayland is an X server for running X clients under Wayland. %package devel Summary: Development package Requires: pkgconfig %description devel The development package provides the developmental files which are necessary for developing Wayland compositors using Xwayland. %prep %autosetup -n xwayland- -p1 %build %meson \ -Ddefault_font_path="catalogue:/etc/X11/fontpath.d,built-ins" \ -Dbuilder_string="Build ID: -" \ -Dxkb_output_dir=/lib/xkb \ -Dxcsecurity=true \ -Dglamor=true \ -Ddri3=true %meson_build

Security Fix(es):

A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service.(CVE-2025-62229)

A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.(CVE-2025-62231)

A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.(CVE-2026-33999)

A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.(CVE-2026-34001)

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.(CVE-2026-34002)

A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible.(CVE-2026-34003)

['Hi all,\n\nCVEs have been issued now, please see inline below\n\nOn Tue, Jun 02, 2026 at 10:01:46AM +1000, Peter Hutterer wrote:', "=======================================================================\nX.Org Security Advisory: June 2, 2026 \n\nIssues in X.Org X server prior to 21.1.23 and Xwayland prior to 24.1.12\n=======================================================================\n\nMultiple issues have been found in the X server and Xwayland implementations\npublished by X.Org for which we are releasing security fixes for in\nxorg-server-21.1.23 and xwayland-24.1.12.\n\nNote that CVEs have been requested for these issues but did not get assigned in\ntime for this disclosure.\n\n* Font Alias Stack-based Buffer Overflow\n\n A mismatch between the X server and the libXfont2 library's maximum\n font name length can cause a stack buffer overflow during font alias\n resolution. The server allocates a 256 byte stack buffer but libXfont2's\n alias target name length is 1024 bytes.…

Xwayland is an X server for running X clients under Wayland. %package devel Summary: Development package Requires: pkgconfig %description devel The development package provides the developmental files which are necessary for developing Wayland compositors using Xwayland. %prep %autosetup -n xwayland- -p1 %build %meson \ -Ddefault_font_path="catalogue:/etc/X11/fontpath.d,built-ins" \ -Dbuilder_string="Build ID: -" \ -Dxkb_output_dir=/lib/xkb \ -Dxcsecurity=true \ -Dglamor=true \ -Ddri3=true %meson_build

Security Fix(es):

A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service.(CVE-2025-62229)

A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.(CVE-2025-62231)

A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.(CVE-2026-33999)

A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.(CVE-2026-34001)

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.(CVE-2026-34002)

A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible.(CVE-2026-34003)

['Hi all,\n\nCVEs have been issued now, please see inline below\n\nOn Tue, Jun 02, 2026 at 10:01:46AM +1000, Peter Hutterer wrote:', "=======================================================================\nX.Org Security Advisory: June 2, 2026 \n\nIssues in X.Org X server prior to 21.1.23 and Xwayland prior to 24.1.12\n=======================================================================\n\nMultiple issues have been found in the X server and Xwayland implementations\npublished by X.Org for which we are releasing security fixes for in\nxorg-server-21.1.23 and xwayland-24.1.12.\n\nNote that CVEs have been requested for these issues but did not get assigned in\ntime for this disclosure.\n\n* Font Alias Stack-based Buffer Overflow\n\n A mismatch between the X server and the libXfont2 library's maximum\n font name length can cause a stack buffer overflow during font alias\n resolution. The server allocates a 256 byte stack buffer but libXfont2's\n alias target name length is 1024 bytes.…

Xwayland is an X server for running X clients under Wayland. %package devel Summary: Development package Requires: pkgconfig %description devel The development package provides the developmental files which are necessary for developing Wayland compositors using Xwayland. %prep %autosetup -n xwayland- -p1 %build %meson \ -Ddefault_font_path="catalogue:/etc/X11/fontpath.d,built-ins" \ -Dbuilder_string="Build ID: -" \ -Dxkb_output_dir=/lib/xkb \ -Dxcsecurity=true \ -Dglamor=true \ -Ddri3=true %meson_build

Security Fix(es):

A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service.(CVE-2025-62229)

A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.(CVE-2025-62231)

A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.(CVE-2026-33999)

A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.(CVE-2026-34001)

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.(CVE-2026-34002)

A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible.(CVE-2026-34003)

['Hi all,\n\nCVEs have been issued now, please see inline below\n\nOn Tue, Jun 02, 2026 at 10:01:46AM +1000, Peter Hutterer wrote:', "=======================================================================\nX.Org Security Advisory: June 2, 2026 \n\nIssues in X.Org X server prior to 21.1.23 and Xwayland prior to 24.1.12\n=======================================================================\n\nMultiple issues have been found in the X server and Xwayland implementations\npublished by X.Org for which we are releasing security fixes for in\nxorg-server-21.1.23 and xwayland-24.1.12.\n\nNote that CVEs have been requested for these issues but did not get assigned in\ntime for this disclosure.\n\n* Font Alias Stack-based Buffer Overflow\n\n A mismatch between the X server and the libXfont2 library's maximum\n font name length can cause a stack buffer overflow during font alias\n resolution. The server allocates a 256 byte stack buffer but libXfont2's\n alias target name length is 1024 bytes.…

Xwayland is an X server for running X clients under Wayland. %package devel Summary: Development package Requires: pkgconfig %description devel The development package provides the developmental files which are necessary for developing Wayland compositors using Xwayland. %prep %autosetup -n xwayland- -p1 %build %meson \ -Ddefault_font_path="catalogue:/etc/X11/fontpath.d,built-ins" \ -Dbuilder_string="Build ID: -" \ -Dxkb_output_dir=/lib/xkb \ -Dxcsecurity=true \ -Dglamor=true \ -Ddri3=true %meson_build

Security Fix(es):

A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.(CVE-2025-62231)

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.(CVE-2026-34002)

A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible.(CVE-2026-34003)

['Hi all,\n\nCVEs have been issued now, please see inline below\n\nOn Tue, Jun 02, 2026 at 10:01:46AM +1000, Peter Hutterer wrote:', "=======================================================================\nX.Org Security Advisory: June 2, 2026 \n\nIssues in X.Org X server prior to 21.1.23 and Xwayland prior to 24.1.12\n=======================================================================\n\nMultiple issues have been found in the X server and Xwayland implementations\npublished by X.Org for which we are releasing security fixes for in\nxorg-server-21.1.23 and xwayland-24.1.12.\n\nNote that CVEs have been requested for these issues but did not get assigned in\ntime for this disclosure.\n\n* Font Alias Stack-based Buffer Overflow\n\n A mismatch between the X server and the libXfont2 library's maximum\n font name length can cause a stack buffer overflow during font alias\n resolution. The server allocates a 256 byte stack buffer but libXfont2's\n alias target name length is 1024 bytes. A font alias name between 257\n and 1023 bytes causes the X server to copy that name into the undersized\n stack buffer without further checks.\n\n Fixed in: xorg-server-21.1.23 and xwayland-24.1.12\n Fix:", 'Found by: Anonymous working with TrendAI Zero Day Initiative.\n (ZDI-CAN-30136)', 'This issue has been assigned CVE-2026-50256', '* XSYNC Use-After-Free in miSyncDestroyFence()\n\n A client that sets up multiple fence triggers can trigger a\n use-after-free function pointer call. An attacker would connect to the\n X server to set up a fence and await that fence, then a second X\n connection destroys the fence, causing the use-after-free.\n\n Fixed in: xorg-server-21.1.23 and xwayland-24.1.12\n Fix:', 'Found by: Anonymous working with TrendAI Zero Day Initiative.\n (ZDI-CAN-30159)', 'This issue has been assigned CVE-2026-50257', '* XKB Key Types Stack-based Buffer Overflow\n\n The X server has multiple stack buffers that are sized\n XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify\n …

Root has patched CVE-2026-34002 in the xorg-server package for Root:Debian:11. Multiple fixed versions available.

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.

• CVE-2026-34002: fix out-of-bounds read in CheckModifierMap() in the bundled xorg-x11-server source by bounds-checking the modifier-map request data

• CVE-2026-34002: fix out-of-bounds read in CheckModifierMap() in the bundled xorg-x11-server source by bounds-checking the modifier-map request data

• CVE-2026-34002: add bounds check in xkb CheckModifierMap() to prevent out-of-bounds read of the modifier map request data

• CVE-2026-34000: fix out-of-bounds read in XKB geometry key alias bounds check in _CheckSetGeom()
• CVE-2026-34002: fix out-of-bounds read in XKB modifier map handling in CheckModifierMap() and add further request-bounds validation

• CVE-2026-34000: fix out-of-bounds read in XKB geometry key alias bounds check in _CheckSetGeom()
• CVE-2026-34002: fix out-of-bounds read in XKB modifier map handling in CheckModifierMap() and add further request-bounds validation

• CVE-2026-34000: fix out-of-bounds read in XKB geometry key alias bounds check in _CheckSetGeom()
• CVE-2026-34002: fix out-of-bounds read in XKB modifier map handling in CheckModifierMap() and add further request-bounds validation

• CVE-2026-34002: add bounds check in xkb CheckModifierMap() to prevent out-of-bounds read of the modifier map request data

XKB Integer Underflow in XkbSetCompatMap(). (CVE-2026-33999) XKB Out-of-bounds Read in CheckSetGeom(). (CVE-2026-34000) XSYNC Use-after-free in miSyncTriggerFence(). (CVE-2026-34001) XKB Out-of-bounds read in CheckModifierMap(). (CVE-2026-34002) XKB Buffer overflow in CheckKeyTypes(). (CVE-2026-34003)

These are all security issues fixed in the xorg-x11-server-21.1.21-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the xwayland-24.1.9-2.1 package on the GA media of openSUSE Tumbleweed.

This update for xorg-x11-server fixes the following issues:

• CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap() (bsc#1260922).
• CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom() (bsc#1260923).
• CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence() (bsc#1260924).
• CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap() (bsc#1260925).
• CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes() (bsc#1260926).

This update for xwayland fixes the following issues:

• CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap() (bsc#1260922).
• CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom() (bsc#1260923).
• CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence() (bsc#1260924).
• CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap() (bsc#1260925).
• CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes() (bsc#1260926).

This update for xwayland fixes the following issues:

• CVE-2026-33999: XKB integer underflow in XkbSetCompatMap() (bsc#1260922).
• CVE-2026-34000: XKB out-of-bounds read in CheckSetGeom() (bsc#1260923).
• CVE-2026-34001: XSYNC use-after-free in miSyncTriggerFence() (bsc#1260924).
• CVE-2026-34002: XKB out-of-bounds read in CheckModifierMap() (bsc#1260925).
• CVE-2026-34003: XKB buffer overflow in CheckKeyTypes() (bsc#1260926).

This update for xwayland fixes the following issues:

• CVE-2026-33999: XKB integer underflow in XkbSetCompatMap() (bsc#1260922).
• CVE-2026-34000: XKB out-of-bounds read in CheckSetGeom() (bsc#1260923).
• CVE-2026-34001: XSYNC use-after-free in miSyncTriggerFence() (bsc#1260924).
• CVE-2026-34002: XKB out-of-bounds read in CheckModifierMap() (bsc#1260925).
• CVE-2026-34003: XKB buffer overflow in CheckKeyTypes() (bsc#1260926).

This update for xorg-x11-server fixes the following issues:

• CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap() (bsc#1260922).
• CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom() (bsc#1260923).
• CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence() (bsc#1260924).
• CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap() (bsc#1260925).
• CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes() (bsc#1260926).