A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xorg-serverUpgrade xwayland | May 6, 2026 | May 5, 2026 |
| Amazon Linux Ami 2 | — | Upgrade tigervnc-server-appletUpgrade xorg-x11-server-develUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-server-minimalUpgrade tigervnc-debuginfoUpgrade tigervnc-licenseUpgrade tigervnc-iconsUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XorgUpgrade tigervnc-serverUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XnestUpgrade tigervncUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-source | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade tigervnc-debuginfoUpgrade tigervncUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-selinuxUpgrade xorg-x11-server-XorgUpgrade tigervnc-licenseUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-develUpgrade tigervnc-debugsourceUpgrade tigervnc-server-minimalUpgrade tigervnc-serverUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XnestUpgrade tigervnc-iconsUpgrade tigervnc-server-module | May 6, 2026 | May 5, 2026 |
| Debian | — | Upgrade xorg-server | May 17, 2026 | May 17, 2026 |
| Freebsd | — | Upgrade xorg-serverUpgrade xwayland | Apr 16, 2026 | Apr 14, 2026 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | Aug 17, 2026 | Aug 17, 2026 |
| Redhat_linux | — | Upgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade tigervncUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-licenseUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-Xorg-debuginfoUpgrade tigervnc-server-appletUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-develUpgrade xorg-x11-server-debuginfoNo solution existsUpgrade tigervnc-server-moduleUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-selinuxUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervnc-icons | May 27, 2026 | May 5, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub