CVE-2026-34002

Name	CVE-2026-34002
Description	A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xorg-server (PTS)	bullseye	2:1.20.11-1+deb11u13	vulnerable
	bullseye (security)	2:1.20.11-1+deb11u17	vulnerable
	bookworm	2:21.1.7-3+deb12u12	fixed
	bookworm (security)	2:21.1.7-3+deb12u11	vulnerable
	trixie	2:21.1.16-1.3+deb13u2	fixed
	trixie (security)	2:21.1.16-1.3+deb13u1	vulnerable
	forky, sid	2:21.1.22-1	fixed
xwayland (PTS)	bookworm	2:22.1.9-1	vulnerable
	trixie	2:24.1.6-1	vulnerable
	forky, sid	2:24.1.11-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
xorg-server	source	bookworm	2:21.1.7-3+deb12u12
xorg-server	source	trixie	2:21.1.16-1.3+deb13u2
xorg-server	source	(unstable)	2:21.1.22-1
xwayland	source	(unstable)	2:24.1.10-1

Notes

[bullseye] - xorg-server <postponed> (Minor issue)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
https://lists.x.org/archives/xorg-announce/2026-April/003677.html
fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/f056ce1cc96ed9261052c31524162c78e458f98c