CVE-2026-34002
Medium · 6.1CVSS
6.1
EPSS
0.5%
Published
May 5, 2026
CISA due date
—
The record
A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Server 15 SP6-LTSS | xorg-x11-server | 0 | 21.1.11-150600.5.25.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | xorg-x11-server | 0 | 21.1.11-150600.5.25.1 |
| openSUSE:Leap 15.6 | xorg-x11-server | 0 | 21.1.11-150600.5.25.1 |
| openSUSE:Leap 15.6 | xwayland | 0 | 24.1.1-150600.5.23.1 |
| openSUSE:Leap 16.0 | xorg-x11-server | 0 | 21.1.15-160000.4.1 |
| openSUSE:Leap 16.0 | xwayland | 0 | 24.1.6-160000.4.1 |
| openSUSE:Tumbleweed | xorg-x11-server | 0 | 21.1.21-5.1 |
| openSUSE:Tumbleweed | xwayland | 0 | 24.1.9-2.1 |
Related vulnerabilities
- CVE-2026-34000 A flaw was found in the X.Org X server. Also affects xorg-x11-server
- CVE-2026-33999 A flaw was found in the X.Org X server. Also affects xorg-x11-server
- CVE-2026-34001 A flaw was found in the X.Org X server. Also affects xorg-x11-server
- CVE-2026-34003 A flaw was found in the X.Org X server's XKB key types request validation. Also affects xorg-x11-server
- CVE-2025-62229 A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension… Also affects xorg-x11-server
- CVE-2025-62230 A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling… Also affects xorg-x11-server
- CVE-2025-62231 A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper… Also affects xorg-x11-server
- CVE-2024-31082 A heap-based buffer over-read vulnerability was found in the X.org server's… Also affects xorg-x11-server