CVE-2026-33999
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Apr 23, 2026
CISA due date
—
The record
A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Server 15 SP6-LTSS | xorg-x11-server | 0 | 21.1.11-150600.5.25.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | xorg-x11-server | 0 | 21.1.11-150600.5.25.1 |
| openSUSE:Leap 15.6 | xorg-x11-server | 0 | 21.1.11-150600.5.25.1 |
| openSUSE:Leap 15.6 | xwayland | 0 | 24.1.1-150600.5.23.1 |
| openSUSE:Leap 16.0 | xorg-x11-server | 0 | 21.1.15-160000.4.1 |
| openSUSE:Leap 16.0 | xwayland | 0 | 24.1.6-160000.4.1 |
| openSUSE:Tumbleweed | xorg-x11-server | 0 | 21.1.21-5.1 |
| openSUSE:Tumbleweed | xwayland | 0 | 24.1.9-2.1 |
Related vulnerabilities
- CVE-2026-34000 A flaw was found in the X.Org X server. Also affects xorg-x11-server
- CVE-2026-34002 A flaw was found in the X.Org X server. Also affects xorg-x11-server
- CVE-2026-34001 A flaw was found in the X.Org X server. Also affects xorg-x11-server
- CVE-2026-34003 A flaw was found in the X.Org X server's XKB key types request validation. Also affects xorg-x11-server
- CVE-2025-62229 A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension… Also affects xorg-x11-server
- CVE-2025-62230 A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling… Also affects xorg-x11-server
- CVE-2025-62231 A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper… Also affects xorg-x11-server
- CVE-2024-31082 A heap-based buffer over-read vulnerability was found in the X.org server's… Also affects xorg-x11-server