X.org X11 Server X Keyboard Extension buffer access with incorrect length value

Summaryinfo

A vulnerability labeled as problematic has been found in X.org X11 Server. Affected by this vulnerability is an unknown functionality of the component X Keyboard Extension. Such manipulation leads to buffer access with incorrect length value. This vulnerability is documented as CVE-2026-34002. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability was found in X.org X11 Server (the affected version unknown). It has been rated as problematic. Affected by this issue is an unknown part of the component X Keyboard Extension. The manipulation with an unknown input leads to a buffer access with incorrect length value vulnerability. Using CWE to declare the problem leads to CWE-805. The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer. Impacted is confidentiality, and availability. CVE summarizes:

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.

The advisory is shared for download at access.redhat.com. This vulnerability is handled as CVE-2026-34002 since 03/25/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 312315 (Oracle Linux 8 : tigervnc (ELSA-2026-13414)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (312315) and EUVD (EUVD-2026-27343). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Windowing System Software

Vendor

• X.org

Name

• X11 Server

License

• open-source

Website

• Vendor: https://www.x.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion