by Kastro CVE-2026-34002
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support — Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling
Description · from the CVE record
A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.
Affected
ProductAffectedFixed inSource
Red Hat Enterprise Linux 10.0 Extended Update Supportsee advisory0:24.1.5-6.el10_0CNA
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONsee advisory0:1.1.0-25.el6_10.16CNA
Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory0:1.20.4-34.el7_9CNA
Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory0:1.8.0-36.el7_9.4CNA
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory0:1.20.10-4.el8_4CNA
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory0:1.11.0-8.el8_4.15CNA
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory0:1.20.10-4.el8_4CNA
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory0:1.11.0-8.el8_4.15CNA
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory0:21.1.3-2.el8_6.6CNA
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory0:1.20.11-7.el8_6CNA
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory0:1.12.0-6.el8_6.17CNA
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onsee advisory0:1.12.0-6.el8_6.17CNA
Scores by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
redhat (CNA)6.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial