CVE-2026-34002
xorg-x11-server: This update for xorg-x11-server fixes the following issues: - CVE-2026-33999: XKB integer underflow in XkbSetCompatM...
CVE-2026-34002 is fixed in 40 products on 1 platform, first by SUSE-SU-2026:1328-1, released April 14, 2026. It is not reported as exploited. Patch Radar priority: Urgent.
Urgent
CVSS
9.1
critical
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0049
42nd percentile
This update for xorg-x11-server fixes the following issues: - CVE-2026-33999: XKB integer underflow in XkbSetCompatMap() (bsc#1260922). - CVE-2026-34000: XKB out-of-bounds read in CheckSetGeom() (bsc#1260923). - CVE-2026-34001: XSYNC use-after-free in miSyncTriggerFence() (bsc#1260924). - CVE-2026-34002: XKB out-of-bounds read in CheckModifierMap() (bsc#1260925). - CVE-2026-34003: XKB buffer overflow in CheckKeyTypes() (bsc#1260926).
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| tigervnc · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc · amzn 2023 | 1.14.1-3.amzn2023.0.5 | ALAS2023-2026-1626 | Apr 27, 2026 |
| tigervnc-debuginfo · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc-debuginfo · amzn 2023 | 1.14.1-3.amzn2023.0.5 | ALAS2023-2026-1626 | Apr 27, 2026 |
| tigervnc-debugsource · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc-debugsource · amzn 2023 | 1.14.1-3.amzn2023.0.5 | ALAS2023-2026-1626 | Apr 27, 2026 |
| tigervnc-icons · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc-icons · amzn 2023 | 1.14.1-3.amzn2023.0.5 | ALAS2023-2026-1626 | Apr 27, 2026 |
| tigervnc-license · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc-license · amzn 2023 | 1.14.1-3.amzn2023.0.5 | ALAS2023-2026-1626 | Apr 27, 2026 |
| tigervnc-selinux · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc-selinux · amzn 2023 | 1.14.1-3.amzn2023.0.5 | ALAS2023-2026-1626 | Apr 27, 2026 |
| tigervnc-server · amzn 2023 | 1.14.1-3.amzn2023.0.5 | ALAS2023-2026-1626 | Apr 27, 2026 |
| tigervnc-server-common · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc-server-common-debuginfo · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc-server-debuginfo · amzn 2023 | 1.14.1-3.amzn2023.0.5 | ALAS2023-2026-1626 | Apr 27, 2026 |
| tigervnc-server-minimal · amzn 2023 | 1.14.1-3.amzn2023.0.5 | ALAS2023-2026-1626 | Apr 27, 2026 |
| tigervnc-server-minimal-debuginfo · amzn 2023 | 1.14.1-3.amzn2023.0.5 | ALAS2023-2026-1626 | Apr 27, 2026 |
| tigervnc-server-module · amzn 2023 | 1.14.1-3.amzn2023.0.5 | ALAS2023-2026-1626 | Apr 27, 2026 |
| tigervnc-server-module-debuginfo · amzn 2023 | 1.14.1-3.amzn2023.0.5 | ALAS2023-2026-1626 | Apr 27, 2026 |
| tigervnc-wayland-server · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc-wayland-server-debuginfo · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc-x11-server · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc-x11-server-debuginfo · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc-x11-server-module · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| tigervnc-x11-server-module-debuginfo · Fedora 43 | 1.16.2-4.fc43 | FEDORA-2026-AD10AFA9CD | Jun 18, 2026 |
| xorg-server · Debian 12.15 (bookworm) | 2:21.1.7-3+deb12u12 | DEBIAN-CVE-2026-34002 | May 15, 2026 |
| xorg-server · Debian 13.5 (trixie) | 2:21.1.16-1.3+deb13u2 | DEBIAN-CVE-2026-34002 | May 15, 2026 |
| xorg-server · Debian 14 | 2:21.1.22-1 | DEBIAN-CVE-2026-34002 | May 15, 2026 |
| xorg-x11-server · opensuse-leap 15.6 | 21.1.11-150600.5.25.1 | SUSE-SU-2026:1331-1 | Apr 14, 2026 |
| xorg-x11-server · opensuse-leap 16.0 | 21.1.15-160000.4.1 | OPENSUSE-SU-2026:20544-1 | Apr 15, 2026 |
| xorg-x11-server · sles 15.6 | 21.1.11-150600.5.25.1 | SUSE-SU-2026:1331-1 | Apr 14, 2026 |
| xorg-x11-server · sles 15.7 | 21.1.15-150700.5.16.1 | SUSE-SU-2026:1330-1 | Apr 14, 2026 |
| xorg-x11-server-Xephyr · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xorg-x11-server-Xephyr-debuginfo · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xorg-x11-server-Xnest · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xorg-x11-server-Xnest-debuginfo · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xorg-x11-server-Xorg · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xorg-x11-server-Xorg-debuginfo · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xorg-x11-server-Xvfb · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xorg-x11-server-Xvfb-debuginfo · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xorg-x11-server-Xwayland · RHEL 10 | 24.1.5-6.el10_0 | RHSA-2026:20563 | Apr 30, 2026 |
| xorg-x11-server-Xwayland · amzn 2023 | 24.1.3-1.amzn2023.0.4 | ALAS2023-2026-1613 | Apr 27, 2026 |
| xorg-x11-server-Xwayland-debuginfo · amzn 2023 | 24.1.3-1.amzn2023.0.4 | ALAS2023-2026-1613 | Apr 27, 2026 |
| xorg-x11-server-Xwayland-debugsource · amzn 2023 | 24.1.3-1.amzn2023.0.4 | ALAS2023-2026-1613 | Apr 27, 2026 |
| xorg-x11-server-Xwayland-devel · amzn 2023 | 24.1.3-1.amzn2023.0.4 | ALAS2023-2026-1613 | Apr 27, 2026 |
| xorg-x11-server-common · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xorg-x11-server-debuginfo · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xorg-x11-server-debugsource · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xorg-x11-server-devel · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xorg-x11-server-source · amzn 2023 | 21.1.13-5.amzn2023.0.9 | ALAS2023-2026-1614 | Apr 27, 2026 |
| xwayland · Debian 14 | 2:24.1.10-1 | DEBIAN-CVE-2026-34002 | May 15, 2026 |
| xwayland · opensuse-leap 15.6 | 24.1.1-150600.5.23.1 | SUSE-SU-2026:1329-1 | Apr 14, 2026 |
| xwayland · opensuse-leap 16.0 | 24.1.6-160000.4.1 | OPENSUSE-SU-2026:20560-1 | Apr 17, 2026 |
| xwayland · sles 15.7 | 24.1.5-150700.3.14.1 | SUSE-SU-2026:1328-1 | Apr 14, 2026 |
| xwayland · sles 16.0 | 24.1.6-160000.4.1 | SUSE-SU-2026:21211-1 | Apr 17, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.