The X.Org project has released fixes for five vulnerabilities affecting all versions of the graphical stack components released prior.
Users and system administrators are advised to update their systems to versions xorg-server 21.1.22 and xwayland 24.1.10. The update addresses five security issues identified with CVE IDs from CVE-2026-33999 to CVE-2026-34003. All were discovered by Jan-Niklas Sohn in collaboration with the TrendAI Zero Day Initiative.
- CVE-2026-33999: Integer Overflow in XkbSetCompatMap() — may lead to a buffer overflow when processing a request.
- CVE-2026-34000: Read Out of Bounds in CheckSetGeom() — a boundary check error in XKB allows for reading uninitialized memory.
- CVE-2026-34001: Use-After-Free in XSYNC — an issue in the synchronization handler can lead to crashes or arbitrary code execution.
- CVE-2026-34002: Read Out of Bounds in CheckModifierMap() — incorrect data validation in the client request leads to reading uninitialized memory.
- CVE-2026-34003: Buffer Overflow in CheckKeyTypes() — improper boundary checks in the function can lead to reading memory beyond the request.
Some distributions, such as Debian, have classified these issues as minor in the context of Xwayland, arguing that Xwayland should not operate with superuser privileges.
Source: linux.org.ru
