A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tigervnc-iconsUpgrade tigervnc-licenseUpgrade tigervnc-selinuxUpgrade tigervncUpgrade tigervnc-server-moduleUpgrade tigervnc-serverUpgrade tigervnc-server-minimal | Jun 24, 2026 | May 19, 2026 |
| Alpine Linux | — | Upgrade xorg-serverUpgrade xwayland | May 6, 2026 | May 5, 2026 |
| Amazon_linux_2023 | — | Upgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-serverUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-server-minimalUpgrade tigervnc-iconsUpgrade xorg-x11-server-develUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xwayland-develUpgrade tigervnc-licenseUpgrade tigervnc-debuginfoUpgrade tigervncUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-XvfbUpgrade tigervnc-selinuxUpgrade xorg-x11-server-Xwayland | May 6, 2026 | May 5, 2026 |
| Debian | — | Upgrade xorg-server | May 17, 2026 | May 17, 2026 |
| Freebsd | — | Upgrade xwaylandUpgrade xorg-server | Apr 16, 2026 | Apr 14, 2026 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | Aug 17, 2026 | Aug 17, 2026 |
| Redhat_linux | — | Upgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-debuginfoUpgrade tigervncUpgrade tigervnc-selinuxNo solution existsUpgrade tigervnc-licenseUpgrade tigervnc-serverUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-sourceUpgrade tigervnc-server-appletUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade tigervnc-server-minimalUpgrade tigervnc-server-moduleUpgrade tigervnc-iconsUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-commonUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-XnestUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xephyr | May 20, 2026 | May 5, 2026 |
| Rocky_linux | — | Upgrade tigervnc-server-module-debuginfoUpgrade tigervnc-debuginfoUpgrade tigervncUpgrade tigervnc-server-debuginfoUpgrade tigervnc-server-moduleUpgrade tigervnc-serverUpgrade tigervnc-debugsourceUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-server-minimal | Jun 1, 2026 | May 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub