A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tigervnc-iconsUpgrade tigervnc-licenseUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XvfbUpgrade tigervnc-selinuxUpgrade tigervnc-server-minimalUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-serverUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-develUpgrade tigervncUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-Xnest | Jun 17, 2026 | Jun 17, 2026 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-XnestUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-XorgUpgrade tigervncUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-server-appletUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-serverUpgrade xorg-x11-server-XvfbUpgrade tigervnc-licenseUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-sourceUpgrade tigervnc-iconsUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-commonUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xdmx | Jun 16, 2026 | Jun 16, 2026 |
| Amazon_linux_2023 | — | Upgrade tigervnc-server-module-debuginfoUpgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-develUpgrade xorg-x11-server-debuginfoUpgrade tigervncUpgrade xorg-x11-server-Xorg-debuginfoUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-commonUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XephyrUpgrade tigervnc-iconsUpgrade tigervnc-server-moduleUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-selinuxUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-debugsourceUpgrade tigervnc-licenseUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-source | Jun 15, 2026 | Jun 5, 2026 |
| Debian | — | Upgrade xorg-server | Jul 23, 2026 | Jul 23, 2026 |
| Freebsd | — | Upgrade xorg-serverUpgrade xwayland | Jun 15, 2026 | Jun 1, 2026 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | Aug 17, 2026 | Aug 17, 2026 |
| Redhat_linux | — | Upgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade tigervnc-server-minimalUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-XorgUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-server-appletUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-commonUpgrade tigervnc-iconsUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade tigervnc-serverUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-XdmxUpgrade tigervnc-debuginfoUpgrade tigervncUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-develUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-licenseUpgrade xorg-x11-server-Xnest-debuginfoNo solution existsUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-XvfbUpgrade tigervnc-selinux | Jun 19, 2026 | Jun 2, 2026 |
| Rocky_linux | — | Upgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xwayland-develUpgrade tigervnc-debuginfoUpgrade tigervnc-server-moduleUpgrade tigervnc-serverUpgrade xorg-x11-server-commonUpgrade tigervnc-server-debuginfoUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-develUpgrade tigervncUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xwayland-debugsource | Jun 22, 2026 | Jun 19, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub