# CVE-2026-34000: xorg-server: A flaw was found in the X.Org X server CVE-2026-34000 is fixed in 32 products on 1 platform, first by SUSE-SU-2026:1328-1, released April 14, 2026. It is not reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/cve/CVE-2026-34000 - Priority: Urgent - CVSS: 9.1 (critical) - EPSS: 0.0049 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 14, 2026 ## Description A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | tigervnc RHEL 9 | 0:1.15.0-7.el9_8.1 | [RHSA-2026:19342](https://patchblox.com/security/data/fix/linux/rhsa-2026-19342.md) | Apr 30, 2026 | | Linux | tigervnc almalinux 9 | 1.15.0-7.el9_8.1 | [ALSA-2026:19342](https://patchblox.com/security/data/fix/linux/alsa-2026-19342.md) | May 19, 2026 | | Linux | tigervnc amzn 2023 | 1.14.1-3.amzn2023.0.5 | [ALAS2023-2026-1626](https://patchblox.com/security/data/fix/linux/alas2023-2026-1626.md) | Apr 27, 2026 | | Linux | tigervnc ol 9 | 0:1.15.0-7.el9_8.1 | [ELSA-2026-19342](https://patchblox.com/security/data/fix/linux/elsa-2026-19342.md) | Jun 23, 2026 | | Linux | tigervnc rocky 9 | 0:1.15.0-7.el9_8.1 | [RLSA-2026:19342](https://patchblox.com/security/data/fix/linux/rlsa-2026-19342.md) | May 28, 2026 | | Linux | tigervnc-debuginfo amzn 2023 | 1.14.1-3.amzn2023.0.5 | [ALAS2023-2026-1626](https://patchblox.com/security/data/fix/linux/alas2023-2026-1626.md) | Apr 27, 2026 | | Linux | tigervnc-debugsource amzn 2023 | 1.14.1-3.amzn2023.0.5 | [ALAS2023-2026-1626](https://patchblox.com/security/data/fix/linux/alas2023-2026-1626.md) | Apr 27, 2026 | | Linux | tigervnc-icons RHEL 9 | 0:1.15.0-7.el9_8.1 | [RHSA-2026:19342](https://patchblox.com/security/data/fix/linux/rhsa-2026-19342.md) | Apr 30, 2026 | | Linux | tigervnc-icons almalinux 9 | 1.15.0-7.el9_8.1 | [ALSA-2026:19342](https://patchblox.com/security/data/fix/linux/alsa-2026-19342.md) | May 19, 2026 | | Linux | tigervnc-icons amzn 2023 | 1.14.1-3.amzn2023.0.5 | [ALAS2023-2026-1626](https://patchblox.com/security/data/fix/linux/alas2023-2026-1626.md) | Apr 27, 2026 | | Linux | tigervnc-icons ol 9 | 0:1.15.0-7.el9_8.1 | [ELSA-2026-19342](https://patchblox.com/security/data/fix/linux/elsa-2026-19342.md) | Jun 23, 2026 | | Linux | tigervnc-license RHEL 9 | 0:1.15.0-7.el9_8.1 | [RHSA-2026:19342](https://patchblox.com/security/data/fix/linux/rhsa-2026-19342.md) | Apr 30, 2026 | | Linux | tigervnc-license almalinux 9 | 1.15.0-7.el9_8.1 | [ALSA-2026:19342](https://patchblox.com/security/data/fix/linux/alsa-2026-19342.md) | May 19, 2026 | | Linux | tigervnc-license amzn 2023 | 1.14.1-3.amzn2023.0.5 | [ALAS2023-2026-1626](https://patchblox.com/security/data/fix/linux/alas2023-2026-1626.md) | Apr 27, 2026 | | Linux | tigervnc-license ol 9 | 0:1.15.0-7.el9_8.1 | [ELSA-2026-19342](https://patchblox.com/security/data/fix/linux/elsa-2026-19342.md) | Jun 23, 2026 | | Linux | tigervnc-selinux RHEL 9 | 0:1.15.0-7.el9_8.1 | [RHSA-2026:19342](https://patchblox.com/security/data/fix/linux/rhsa-2026-19342.md) | Apr 30, 2026 | | Linux | tigervnc-selinux almalinux 9 | 1.15.0-7.el9_8.1 | [ALSA-2026:19342](https://patchblox.com/security/data/fix/linux/alsa-2026-19342.md) | May 19, 2026 | | Linux | tigervnc-selinux amzn 2023 | 1.14.1-3.amzn2023.0.5 | [ALAS2023-2026-1626](https://patchblox.com/security/data/fix/linux/alas2023-2026-1626.md) | Apr 27, 2026 | | Linux | tigervnc-selinux ol 9 | 0:1.15.0-7.el9_8.1 | [ELSA-2026-19342](https://patchblox.com/security/data/fix/linux/elsa-2026-19342.md) | Jun 23, 2026 | | Linux | tigervnc-server RHEL 9 | 0:1.15.0-7.el9_8.1 | [RHSA-2026:19342](https://patchblox.com/security/data/fix/linux/rhsa-2026-19342.md) | Apr 30, 2026 | | Linux | tigervnc-server almalinux 9 | 1.15.0-7.el9_8.1 | [ALSA-2026:19342](https://patchblox.com/security/data/fix/linux/alsa-2026-19342.md) | May 19, 2026 | | Linux | tigervnc-server amzn 2023 | 1.14.1-3.amzn2023.0.5 | [ALAS2023-2026-1626](https://patchblox.com/security/data/fix/linux/alas2023-2026-1626.md) | Apr 27, 2026 | | Linux | tigervnc-server ol 9 | 0:1.15.0-7.el9_8.1 | [ELSA-2026-19342](https://patchblox.com/security/data/fix/linux/elsa-2026-19342.md) | Jun 23, 2026 | | Linux | tigervnc-server-debuginfo amzn 2023 | 1.14.1-3.amzn2023.0.5 | [ALAS2023-2026-1626](https://patchblox.com/security/data/fix/linux/alas2023-2026-1626.md) | Apr 27, 2026 | | Linux | tigervnc-server-minimal RHEL 9 | 0:1.15.0-7.el9_8.1 | [RHSA-2026:19342](https://patchblox.com/security/data/fix/linux/rhsa-2026-19342.md) | Apr 30, 2026 | | Linux | tigervnc-server-minimal almalinux 9 | 1.15.0-7.el9_8.1 | [ALSA-2026:19342](https://patchblox.com/security/data/fix/linux/alsa-2026-19342.md) | May 19, 2026 | | Linux | tigervnc-server-minimal amzn 2023 | 1.14.1-3.amzn2023.0.5 | [ALAS2023-2026-1626](https://patchblox.com/security/data/fix/linux/alas2023-2026-1626.md) | Apr 27, 2026 | | Linux | tigervnc-server-minimal ol 9 | 0:1.15.0-7.el9_8.1 | [ELSA-2026-19342](https://patchblox.com/security/data/fix/linux/elsa-2026-19342.md) | Jun 23, 2026 | | Linux | tigervnc-server-minimal-debuginfo amzn 2023 | 1.14.1-3.amzn2023.0.5 | [ALAS2023-2026-1626](https://patchblox.com/security/data/fix/linux/alas2023-2026-1626.md) | Apr 27, 2026 | | Linux | tigervnc-server-module RHEL 9 | 0:1.15.0-7.el9_8.1 | [RHSA-2026:19342](https://patchblox.com/security/data/fix/linux/rhsa-2026-19342.md) | Apr 30, 2026 | | Linux | tigervnc-server-module almalinux 9 | 1.15.0-7.el9_8.1 | [ALSA-2026:19342](https://patchblox.com/security/data/fix/linux/alsa-2026-19342.md) | May 19, 2026 | | Linux | tigervnc-server-module amzn 2023 | 1.14.1-3.amzn2023.0.5 | [ALAS2023-2026-1626](https://patchblox.com/security/data/fix/linux/alas2023-2026-1626.md) | Apr 27, 2026 | | Linux | tigervnc-server-module ol 9 | 0:1.15.0-7.el9_8.1 | [ELSA-2026-19342](https://patchblox.com/security/data/fix/linux/elsa-2026-19342.md) | Jun 23, 2026 | | Linux | tigervnc-server-module-debuginfo amzn 2023 | 1.14.1-3.amzn2023.0.5 | [ALAS2023-2026-1626](https://patchblox.com/security/data/fix/linux/alas2023-2026-1626.md) | Apr 27, 2026 | | Linux | xorg-server Debian 12.15 (bookworm) | 2:21.1.7-3+deb12u12 | [DEBIAN-CVE-2026-34000](https://patchblox.com/security/data/fix/linux/debian-cve-2026-34000.md) | May 15, 2026 | | Linux | xorg-server Debian 13.5 (trixie) | 2:21.1.16-1.3+deb13u2 | [DEBIAN-CVE-2026-34000](https://patchblox.com/security/data/fix/linux/debian-cve-2026-34000.md) | May 15, 2026 | | Linux | xorg-server Debian 14 | 2:21.1.22-1 | [DEBIAN-CVE-2026-34000](https://patchblox.com/security/data/fix/linux/debian-cve-2026-34000.md) | May 15, 2026 | | Linux | xorg-x11-server opensuse-leap 15.6 | 21.1.11-150600.5.25.1 | [SUSE-SU-2026:1331-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1331-1.md) | Apr 14, 2026 | | Linux | xorg-x11-server opensuse-leap 16.0 | 21.1.15-160000.4.1 | [OPENSUSE-SU-2026:20544-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20544-1.md) | Apr 15, 2026 | | Linux | xorg-x11-server sles 15.6 | 21.1.11-150600.5.25.1 | [SUSE-SU-2026:1331-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1331-1.md) | Apr 14, 2026 | | Linux | xorg-x11-server sles 15.7 | 21.1.15-150700.5.16.1 | [SUSE-SU-2026:1330-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1330-1.md) | Apr 14, 2026 | | Linux | xorg-x11-server-Xephyr amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xorg-x11-server-Xephyr-debuginfo amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xorg-x11-server-Xnest amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xorg-x11-server-Xnest-debuginfo amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xorg-x11-server-Xorg amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xorg-x11-server-Xorg-debuginfo amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xorg-x11-server-Xvfb amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xorg-x11-server-Xvfb-debuginfo amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xorg-x11-server-Xwayland RHEL 10 | 24.1.5-6.el10_0 | [RHSA-2026:20563](https://patchblox.com/security/data/fix/linux/rhsa-2026-20563.md) | Apr 30, 2026 | | Linux | xorg-x11-server-Xwayland amzn 2023 | 24.1.3-1.amzn2023.0.4 | [ALAS2023-2026-1613](https://patchblox.com/security/data/fix/linux/alas2023-2026-1613.md) | Apr 27, 2026 | | Linux | xorg-x11-server-Xwayland-debuginfo amzn 2023 | 24.1.3-1.amzn2023.0.4 | [ALAS2023-2026-1613](https://patchblox.com/security/data/fix/linux/alas2023-2026-1613.md) | Apr 27, 2026 | | Linux | xorg-x11-server-Xwayland-debugsource amzn 2023 | 24.1.3-1.amzn2023.0.4 | [ALAS2023-2026-1613](https://patchblox.com/security/data/fix/linux/alas2023-2026-1613.md) | Apr 27, 2026 | | Linux | xorg-x11-server-Xwayland-devel amzn 2023 | 24.1.3-1.amzn2023.0.4 | [ALAS2023-2026-1613](https://patchblox.com/security/data/fix/linux/alas2023-2026-1613.md) | Apr 27, 2026 | | Linux | xorg-x11-server-common amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xorg-x11-server-debuginfo amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xorg-x11-server-debugsource amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xorg-x11-server-devel amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xorg-x11-server-source amzn 2023 | 21.1.13-5.amzn2023.0.9 | [ALAS2023-2026-1614](https://patchblox.com/security/data/fix/linux/alas2023-2026-1614.md) | Apr 27, 2026 | | Linux | xwayland Debian 14 | 2:24.1.10-1 | [DEBIAN-CVE-2026-34000](https://patchblox.com/security/data/fix/linux/debian-cve-2026-34000.md) | May 15, 2026 | | Linux | xwayland opensuse-leap 15.6 | 24.1.1-150600.5.23.1 | [SUSE-SU-2026:1329-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1329-1.md) | Apr 14, 2026 | | Linux | xwayland opensuse-leap 16.0 | 24.1.6-160000.4.1 | [OPENSUSE-SU-2026:20560-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20560-1.md) | Apr 17, 2026 | | Linux | xwayland sles 15.7 | 24.1.5-150700.3.14.1 | [SUSE-SU-2026:1328-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1328-1.md) | Apr 14, 2026 | | Linux | xwayland sles 16.0 | 24.1.6-160000.4.1 | [SUSE-SU-2026:21211-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-21211-1.md) | Apr 17, 2026 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.