Corrective releases of X.Org Server 21.1.22 and the DDX component (Device-Dependent X) xwayland 24.1.10 have been published, enabling the launch of X.Org Server to facilitate the execution of X11 applications in Wayland-based environments. The new versions address five vulnerabilities. Some vulnerabilities could potentially be exploited to escalate privileges in systems where the X server runs with root permissions, as well as for remote code execution in configurations that use X11 session redirection via SSH.
Fixed vulnerabilities:
- CVE-2026-34001 — a use-after-free vulnerability in the function miSyncTriggerFence(). This vulnerability has been present since the release of xorg-server 1.9.0 (2010).
- CVE-2026-33999 — an integer underflow in the function XkbSetCompatMap(), leading to reading data from outside the buffer when processing specially crafted requests. This vulnerability has been present since the release of X11R6.6 (2001).
- CVE-2026-34000 — reading from outside the buffer in the function XkbAddGeomKeyAlias, caused by a lack of size verification for the passed key name against the allocated buffer. This vulnerability has been present since the releases of xorg-server 21.1.4 and xwayland 22.1.3 (2022).
- CVE-2026-34002 — reading from outside the buffer in the function CheckModifierMap() due to a lack of checks on the number of specified keys in the request against the actual number of parameters passed. This vulnerability has been present since the release of X11R6.6 (2001).
- CVE-2026-34003 — a buffer overflow in the XKB function CheckKeyTypes(), leading to reading data from outside the buffer due to a lack of size validation for the data passed in the request. This vulnerability has been present since the release of X11R6.6 (2001).
Source: opennet.ru
