# CVE-2026-34000: X.Org X server out-of-bounds read in XKB geometry processing

Source: https://junglewise.ai/threats/cve-2026-34000-x-org-x-server-out-of-bounds-read-in-xkb-geometry-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-34000 · Severity: medium · CVSS 6.1 · Published 2026-05-05

A security flaw has been identified in the X.Org X server, a fundamental component used to manage graphical displays on Linux and Unix-like operating systems. An attacker with access to the system can exploit this vulnerability to crash the display server or potentially view sensitive information stored in the system's memory. This could lead to a disruption of service for users or the unauthorized disclosure of private data.

Technologies: [Tigervnc](https://junglewise.ai/threats/technologies/tigervnc). Vendors: [Tigervnc](https://junglewise.ai/threats/vendors/tigervnc).

## Quick answers

**Is CVE-2026-34000 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34000 being exploited in the wild.

**How severe is CVE-2026-34000?** Medium severity, with a CVSS score of 6.1, published 5 May 2026.

**Which products and versions are affected?** Tigervnc 1.15.0-7.el9_8.1 and earlier.

**Is there a fix for CVE-2026-34000?** A patch was published on 2026-05-19: Red Hat released security updates (RHSA-2026:19342) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34000 attacked?** It is attacked over the network or with local access, in an operating system.

**Am I affected by CVE-2026-34000?** Check whether you run Tigervnc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in the X.Org X server within the XKB geometry processing logic. The root cause is located in the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, where bounds checking is incorrectly performed using only the first key name of each alias entry, failing to validate the second name. An attacker with a local or remote connection to the X11 server can trigger this flaw without user interaction by sending a specially crafted request. Successful exploitation allows the attacker to read uninitialized or out-of-bounds memory, potentially leaking sensitive data or causing the server to crash (DoS). Red Hat has released patches for RHEL 9 via RHSA-2026:19342.

## Affected products

- X.Org X Server All versions prior to fix
- Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0, 10.0
- TigerVNC TigerVNC 1.15.0-7.el9_8.1 and earlier

## Timeline

- 2026-03-25: disclosed: Initial report in Red Hat Bugzilla
- 2026-05-05: advisory: NVD publication date
- 2026-05-19: patched: Red Hat released security updates (RHSA-2026:19342)

## References

- [https://access.redhat.com/errata/RHSA-2026:19342](https://access.redhat.com/errata/RHSA-2026:19342)
- [https://access.redhat.com/security/cve/CVE-2026-34000](https://access.redhat.com/security/cve/CVE-2026-34000)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2451107](https://bugzilla.redhat.com/show_bug.cgi?id=2451107)

## Related threats

- [X.Org X server out-of-bounds memory access in XKB request validation](https://junglewise.ai/threats/cve-2026-34003-x-org-x-server-out-of-bounds-memory-access-in-xkb-request)
- [X.Org X server use-after-free in miSyncTriggerFence](https://junglewise.ai/threats/cve-2026-34001-x-org-x-server-use-after-free-in-misynctriggerfence)
- [X.Org X server integer underflow in XKB compatibility map handling](https://junglewise.ai/threats/cve-2026-33999-x-org-x-server-integer-underflow-in-xkb-compatibility-map)
- [TigerVNC x0vncserver incorrect permissions in shared memory image](https://junglewise.ai/threats/cve-2026-34352-tigervnc-x0vncserver-incorrect-permissions-in-shared-memory-image)