Description
A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.
Published: 2026-04-23
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service and potential memory corruption
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a use‑after‑free in the XSync fence triggering logic of the X.Org X server. It can crash the server and potentially corrupt memory, leading to denial of service and possibly further compromise. The flaw is identified as CWE‑825.

Affected Systems

Red Hat Enterprise Linux 6 through 10 that include the X.Org X server are affected. The update for the X.Org X server is included in Red Hat errata RHSA‑2026:10739. Vendor version information is not specified in the data.

Risk and Exploitability

The CVSS score of 7.8 categorizes this as a high‑severity flaw, while the EPSS score of less than 1% indicates that the probability of exploitation is low and that there is no current listing in the CISA KEV catalog. An attacker with access to the X11 server can exploit the flaw without user interaction; exposure may be local or remote if the X server is reachable from an untrusted network. The use‑after‑free can cause a crash and may lead to memory corruption, which could be leveraged for further system compromise.

Generated by OpenCVE AI on April 28, 2026 at 07:34 UTC.

Remediation

Vendor Workaround

To mitigate this issue, restrict access to the X11 server to trusted users and networks. If the X.Org X server is not required, consider disabling or uninstalling it. For environments where the X server is essential, running X applications within a sandboxed environment can help reduce the attack surface.

OpenCVE Recommended Actions

  • Apply the Red Hat update RHSA‑2026:10739 to upgrade the X.Org X server to the patched version.
  • Restrict access to the X11 server to trusted users and networks or disable the X server if it is not required.
  • If the X server is required, run X applications within a sandboxed environment to reduce the attack surface.
  • Ensure the X11 server is not exposed remotely, e.g., by restricting X11 forwarding and blocking connections on the listening port with firewall rules.

Generated by OpenCVE AI on April 28, 2026 at 07:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:10739 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:11352 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:11369 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:11388 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:11656 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:11692 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:13414 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:19125 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:19342 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:19343 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:19344 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20547 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20555 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20557 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20558 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20560 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20561 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20562 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20563 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20575 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20576 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20590 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21699 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21712 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21715 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21716 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21718 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21741 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21742 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:22424 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:22456 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2026-34001 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2451109 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-34001 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-34001 cve-icon
History

Wed, 03 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:7
References

Tue, 02 Jun 2026 10:00:00 +0000

Type Values Removed Values Added
References

Thu, 28 May 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus Long Life
CPEs cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Vendors & Products Redhat rhel Eus Long Life
References

Thu, 28 May 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
Vendors & Products Redhat rhel Aus
Redhat rhel Tus
References

Thu, 28 May 2026 08:45:00 +0000

Type Values Removed Values Added
References

Tue, 26 May 2026 09:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
References

Tue, 26 May 2026 06:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_eus:9.4::crb
References

Tue, 26 May 2026 05:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhel Els
CPEs cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/a:redhat:rhel_eus:9.6::crb
cpe:/o:redhat:enterprise_linux_eus:10.0
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat enterprise Linux Eus
Redhat rhel Els
References

Tue, 26 May 2026 03:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.4::appstream
Vendors & Products Redhat rhel Eus
References

Tue, 26 May 2026 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.0::appstream
Vendors & Products Redhat rhel E4s
References

Wed, 20 May 2026 03:30:00 +0000

Type Values Removed Values Added
References

Tue, 19 May 2026 22:00:00 +0000

Type Values Removed Values Added
References

Tue, 19 May 2026 21:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.2
References

Mon, 04 May 2026 13:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8
References

Wed, 29 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
References

Wed, 29 Apr 2026 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
References

Tue, 28 Apr 2026 22:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9
References

Tue, 28 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9::crb
References

Tue, 28 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.1
References

Tue, 28 Apr 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared X.org
X.org x.org
Vendors & Products X.org
X.org x.org

Mon, 27 Apr 2026 10:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9::appstream
References

Fri, 24 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 23 Apr 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Apr 2026 15:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.
Title Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-825
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Redhat Enterprise Linux Enterprise Linux Eus Rhel Aus Rhel E4s Rhel Els Rhel Eus Rhel Eus Long Life Rhel Tus
X.org X.org
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-06-02T22:08:52.556Z

Reserved: 2026-03-25T04:53:13.615Z

Link: CVE-2026-34001

cve-icon Vulnrichment

Updated: 2026-04-23T16:19:27.184Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-23T16:16:24.777

Modified: 2026-06-02T23:16:36.647

Link: CVE-2026-34001

cve-icon Redhat

Severity : Important

Publid Date: 2026-04-23T14:14:42Z

Links: CVE-2026-34001 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T09:25:59Z

Weaknesses