Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
Important: X.Org X server Xwayland Denial of Service and Crash Risk
published 6 months ago
Summary
An update is available for the X.Org X server Xwayland component to fix three security issues. These issues could allow an attacker to crash the server, steal sensitive information, or cause the server to stop working. We recommend installing the latest update to ensure the security and stability of your system.
What to do
- Update rocky xorg-x11-server-xwayland to version 0:23.2.7-6.el9_7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:9 | rocky | xorg-x11-server-xwayland |
< 0:23.2.7-6.el9_7 Fix: upgrade to 0:23.2.7-6.el9_7
|
Original advisory text
Important: xorg-x11-server-Xwayland security update
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
* xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)
* xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)
* xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)
* xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)
* xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:11369 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2451106 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2451109 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2451113 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published29 Apr 2026
Updated6 May 2026
First seen6 May 2026
Sources
RLSA-2026:11369 · OSV
Track software like this
Free during beta