CVE-2026-34001

Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption

View on CVE.org
Published Apr 23, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.

Analysis

AI-generated

Technical impact

The vulnerability is a use‑after‑free in the XSync fence triggering logic of the X.Org X server. It can crash the server and potentially corrupt memory, leading to denial of service and possibly further compromise. The flaw is identified as CWE‑825.

Affected Systems

Red Hat Enterprise Linux 6 through 10 that include the X.Org X server are affected. The update for the X.Org X server is included in Red Hat errata RHSA‑2026:10739. Vendor version information is not specified in the data.

Risk and Exploitability

The CVSS score of 7.8 categorizes this as a high‑severity flaw, while the EPSS score of less than 1% indicates that the probability of exploitation is low and that there is no current listing in the CISA KEV catalog. An attacker with access to the X11 server can exploit the flaw without user interaction; exposure may be local or remote if the X server is reachable from an untrusted network. The use‑after‑free can cause a crash and may lead to memory corruption, which could be leveraged for further system compromise.

Remediation

Vendor Workaround

To mitigate this issue, restrict access to the X11 server to trusted users and networks. If the X.Org X server is not required, consider disabling or uninstalling it. For environments where the X server is essential, running X applications within a sandboxed environment can help reduce the attack surface.

OpenCVE Recommended Actions

  • Apply the Red Hat update RHSA‑2026:10739 to upgrade the X.Org X server to the patched version.
  • Restrict access to the X11 server to trusted users and networks or disable the X server if it is not required.
  • If the X server is required, run X applications within a sandboxed environment to reduce the attack surface.
  • Ensure the X11 server is not exposed remotely, e.g., by restricting X11 forwarding and blocking connections on the listening port with firewall rules.

Generated by OpenCVE AI on April 28, 2026 at 07:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4738-1 xorg-server security update
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:10739 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:11352 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:11369 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:11388 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:11656 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:11692 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:13414 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:19125 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:19342 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:19343 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:19344 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20547 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20555 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20557 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20558 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20560 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20561 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20562 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20563 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20575 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20576 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20590 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21699 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21712 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21715 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21716 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21718 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21741 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:21742 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:22424 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:22456 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:23254 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:23255 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:23496 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:24341 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2026-34001 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2451109 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-34001 cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34001.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-34001 cve-icon
History
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:6
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhel_els:6
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:7
References
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Redhat rhel Eus Long Life
CPEs cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Vendors & Products Redhat rhel Eus Long Life
References
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
Vendors & Products Redhat rhel Aus
Redhat rhel Tus
References
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_eus:9.4::crb
References
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhel Els
CPEs cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/a:redhat:rhel_eus:9.6::crb
cpe:/o:redhat:enterprise_linux_eus:10.0
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat enterprise Linux Eus
Redhat rhel Els
References
Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.4::appstream
Vendors & Products Redhat rhel Eus
References
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.0::appstream
Vendors & Products Redhat rhel E4s
References
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.2
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8
References
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9::crb
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.1
References
Type Values Removed Values Added
First Time appeared X.org
X.org x.org
Vendors & Products X.org
X.org x.org
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9::appstream
References
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.
Title Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-825
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (24)
Weaknesses
  • CWE-825

    Expired Pointer Dereference

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 4, 2026, 10:25 PM
Reserved
Mar 25, 2026, 4:53 AM

View source JSON

Updated
Jul 15, 2026, 1:04 AM

JSON

Status
Awaiting Analysis
Published
Apr 23, 2026, 4:16 PM
Modified
Nov 4, 2026, 11:17 PM

View source JSON

Severity
Important
Public date
Apr 23, 2026, 2:14 PM

View source Bugzilla JSON

Updated
Apr 28, 2026, 9:25 AM

JSON