Multiple vulnerabilities in the X.Org X server, specifically within XWayland's XKB compatibility map, geometry, and modifier map handling, allow for denial of service, information disclosure, and potential memory corruption via integer underflows, out-of-bounds reads, and use-after-free conditions. The CVSS scores for the detailed CVEs include a 7.8 (HIGH) for CVE-2026-33999 and CVE-2026-34001. Affected versions include Red Hat Enterprise Linux 6.0, 7.0, 8.0, and 9.0, and an update is available for Red Hat Enterprise Linux 9.4 Extended Update Support.
Red Hat Product Errata RHSA-2026:20555 - Security Advisory Issued: 2026-05-26 Updated: 2026-05-26 RHSA-2026:20555 - Security Advisory Overview Updated Packages Synopsis Important: xorg-x11-server security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for xorg-x11-server is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) xwayland: xorg: X.Org X server: Information disclosure and denial of service via out-of-bounds read in XKB geometry processing. (CVE-2026-34000) xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) xorg: xwayland: X.Org X server: Information disclosure or Denial of Service via out-of-bounds read in XKB modifier map handling (CVE-2026-34002) xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64 Red Hat Enterprise Linux Server - AUS 9.4 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.4 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.4 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.4 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.4 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x Fixes BZ - 2451106 - CVE-2026-33999 xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling BZ - 2451107 - CVE-2026-34000 xwayland: xorg: X.Org X server: Information disclosure and denial of service via out-of-bounds read in XKB geometry processing. BZ - 2451109 - CVE-2026-34001 xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption BZ - 2451112 - CVE-2026-34002 xorg: xwayland: X.Org X server: Information disclosure or Denial of Service via out-of-bounds read in XKB modifier map handling BZ - 2451113 - CVE-2026-34003 xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access CVEs CVE-2026-33999 CVE-2026-34000 CVE-2026-34001 CVE-2026-34002 CVE-2026-34003 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 SRPM xorg-x11-server-1.20.11-28.el9_4.src.rpm SHA-256: 711cd767b934290f1b924d9f28234c9ae50f547e51a8664b98cda403597f6ee8 x86_64 xorg-x11-server-Xdmx-1.20.11-28.el9_4.x86_64.rpm SHA-256: 75cf5d6f105fb9863b9d63e6b3a7c4de7619ddba770f695eb5b9074e5dcdba72 xorg-x11-server-Xdmx-debuginfo-1.20.11-28.el9_4.x86_64.rpm SHA-256: 3e0cd72f2aea137dda2f053d39ef8475e8646e4e719bb93c1d0da710ac5bbbd0 xorg-x11-server-Xephyr-1.20.11-28.el9_4.x86_64.rpm SHA-256: 484c9f3597f47bc11473410c948d9fa983f2f171d91f7ffc48621d47db189749 xorg-x11-server-Xephyr-debuginfo-1.20.11-28.el9_4.x86_64.rpm SHA-256: 9a1439739a0829cc895e8cc720642f29d29adc1c7845c596cf782130498a4ce2 xorg-x11-server-Xnest-1.20.11-28.el9_4.x86_64.rpm SHA-256: 8babb68aba6d57cabb345b58ff2a6d910b7f9dd4bdc3fea919574c08d19e342c xorg-x11-server-Xnest-debuginfo-1.20.11-28.el9_4.x86_64.rpm SHA-256: dbe0a25a9cb682b8e92987a7c77bb126fbfa1e8f081917554e5c549a89215135 xorg-x11-server-Xorg-1.20.11-28.el9_4.x86_64.rpm SHA-256: 6986ba5e168d90a92c58c673f001e79d9e40ba1e7bab1a54f3c6f1b821c83ff2 xorg-x11-server-Xorg-debuginfo-1.20.11-28.el9_4.x86_64.rpm SHA-256: a4ffb3f86ab4a05a9b8af31d2b39affe7e66771175dafe59bddb6c753cd9ffbb xorg-x11-server-Xvfb-1.20.11-28.el9_4.x86_64.rpm SHA-256: d9d4b5d35619baa021a7d178a26b570c4c00980bd520fa24111d336e7b4e366b xorg-x11-server-Xvfb-debuginfo-1.20.11-28.el9_4.x86_64.rpm SHA-256: 2b44b2390eeb20278f2db2e98d41f735fd3d8f38ec0ab084eae8c9c35e4f31aa xorg-x11-server-common-1.20.11-28.el9_4.x86_64.rpm SHA-256: db5c9792d0d34582737821011ce9c07f8f90fbfec27b95b1e6b7d5191c286945 xorg-x11-server-debuginfo-1.20.11-28.el9_4.x86_64.rpm SHA-256: 3df605c477b14d5cc30df397ee78a9f58b53920fceeb51aa07bf4a3d9fff8b6c xorg-x11-server-debugsource-1.20.11-28.el9_4.x86_64.rpm SHA-256: b4fb474f3add186a9fb1cf1b57833165b0e41f75b41933b25908b119ff17b2b9 Red Hat Enterprise Linux Server - AUS 9.4 SRPM xorg-x11-server-1.20.11-28.el9_4.src.rpm SHA-256: 711cd767b934290f1b924d9f28234c9ae50f547e51a8664b98cda403597f6ee8 x86_64 xorg-x11-server-Xdmx-1.20.11-28.el9_4.x86_64.rpm SHA-256: 75cf5d6f105fb9863b9d63e6b3a7c4de7619ddba770f695eb5b9074e5dcdba72 xorg-x11-server-Xdmx-debuginfo-1.20.11-28.el9_4.x86_64.rpm SHA-256: 3e0cd72f2aea137dda2f053d39ef8475e8646e4e719bb93c1d0da710ac5bbbd0 xorg-x11-server-Xephyr-1.20.11-28.el9_4.x86_64.rpm SHA-256: 484c9f3597f47bc11473410c948d9fa983f2f171d91f7ffc48621d47db189749 xorg-x11-server-Xephyr-debuginfo-1.20.11-28.el9_4.x86_64.rpm SHA-256: 9a1439739a0829cc895e8cc720642f29d29adc1c7845c596cf782130498a4ce2 xorg-x11-server-Xnest-1.20.11-28.el9_4.x86_64.rpm SHA-256: 8babb68aba6d57cabb345b58ff2a6d910b7f9dd4bdc3fea919574c08d19e342c xorg-x11-server-Xnest-debuginfo-1.20.11-28.el9_4.x86_64.rpm SHA-256: dbe0a25a9cb682b8e92987a7c77bb126fbfa1e8f081917554e5c549a89215135 xorg-x11-server-Xorg-1.20.11-28.el9_4.x86_64.rpm SHA-256: 6986ba5e168d90a92c58c673f001e79d9e40ba1e7bab1a54f3c6f1b821c83ff2 xorg-x11-server-Xorg-debuginfo-1.20.11-28.el9_4.x86_64.rpm SHA-256: a4ffb3f86ab4a05a9b8af31d2b39affe7e66771175dafe59bddb6c753cd9ffbb xorg-x11-server-Xvfb-1.20.11-28.el9_4.x86_64.rpm SHA-256: d9d4b5d35619baa021a7d178a26b570c4c00980bd520fa24111d336e7b4e366b xorg-x11-server-Xvfb-debuginfo-1.20.11-28.el9_4.x86_64.rpm SHA-256: 2b44b2390eeb20278f2db2e98d41f735fd3d8f38ec0ab084eae8c9c35e4f31aa xorg-x11-server-common-1.20.11-28.el9_4.x86_64.rpm SHA-256: db5c9792d0d34582737821011ce9c07f8f90fbfec27b95b1e6b7d5191c286945 xorg-x11-server-debuginfo-1.20.11-28.el9_4.x86_64.rpm SHA-256: 3df605c477b14d5cc30df397ee78a9f58b53920fceeb51aa07bf4a3d9fff8b6c xorg-x11-server-debugsource-1.20.11-28.el9_4.x86_64.rpm SHA-256: b4fb474f3add186a9fb1cf1b57833165b0e41f75b41933b25908b119ff17b2b9 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 SRPM xorg-x11-server-1.20.11-28.el9_4.src.rpm SHA-256: 711cd767b934290f1b924d9f28234c9ae50f547e51a8664b98cda403597f6ee8 s390x xorg-x11-server-Xdmx-1.20.11-28.el9_4.s390x.rpm SHA-256: e14e7b0b2bef8214743171447e5dcc4d5eb410517813b44166bb2bbe4939152a xorg-x11-server-Xdmx-debuginfo-1.20.11-28.el9_4.s390x.rpm SHA-256: 3bf2d090de2aa11a0e0c3ebb78a3915d3c249a3869dfe5a3c6e18eff17a53c80 xorg-x11-server-Xephyr-1.20.11-28.el9_4.s390x.rpm SHA-256: eb151c3c8a73977bfef41b9b088dd939b7acb9cd059bd14844d97bfada181a25 xorg-x11-server-Xephyr-debuginfo-1.20.11-28.el9_4.s390x.rpm SHA-256: 47c52ea86f12ef3a35632cb49cd574f5be9c442663536721b72530a84e546517 xorg-x11-server-Xnest-1.20.11-28.el9_4.s390x.rpm SHA-256: ba01a058f1e7d3b13e938fc1167fc800f095b73f520237b857b67625eb321607 xorg-x11-server-Xnest-debuginfo-1.20.11-28.el9_4.s390x.rpm SHA-256: a91ba9606835a941bb3bd57cc5353f2349baa729af3832acfec6fe78fa6b208a xorg-x11-server-Xorg-1.20.11-28.el9_4.s390x.rpm SHA-256: 2919960164755a9a105139616d722f7238b7a7f14e58378644658121e964b3b0 xorg-x11-server-Xorg-debuginfo-1.20.11-28.el9_4.s390x.rpm SHA-256: c6259f0597aad740aed2a6525f423b81355fe66e6b3c32fdd50ecd85fcf7c8f8 xorg-x11-server-Xvfb-1.20.11-28.el9_4.s390x.rpm SHA-256: f379ae1576a04ea12b3a941882dee25256878723c56555d0070ed7e34c8b5622 xorg-x11-server-Xvfb-debuginfo-1.20.11-28.el9_4.s390x.rpm SHA-256: 6d6e2dd1db6bcb8bc7ac258d8e19b9ba2a71ce2e5139989a9d92fd0218eb37e0 xorg-x11-server-common-1.20.11-28.el9_4.s390x.rpm SHA-256: 66895154567ac917369ce64ccaed5520b1c453948ba26ff1d4e7b4f4f35c5014 xorg-x11-server-debuginfo-1.20.11-28.el9_4.s390x.rpm SHA-256: 2afe0fc175d6fbb0be9fa55337f0ed0ca810361fb140930f2716d06556241368 xorg-x11-server-debugsource-1.20.11-28.el9_4.s390x.rpm SHA-256: c1170e5932ed057eff09d4e33a4d659f08208051d2c420f4ba475ead0c702b1c Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 SRPM xorg-x11-server-1.20.11-28.el9_4.src.rpm SHA-256: 71