CVE-2026-34000 is a medium severity (CVSS 6.1) out-of-bounds read in the X.Org X server, in the XKB geometry code. It can leak memory or crash the server. The record does not give an upstream fixed version, so install the updated X server package from your distribution and check its advisory.
What's affected
The record lists the X.Org X server and Red Hat Enterprise Linux. The faulty code is in CheckSetGeom() and XkbAddGeomKeyAlias within XKB geometry processing.
The record does not state an upstream fixed version. Red Hat links several errata to it, including RHSA-2026:19342 and RHSA-2026:20547. I could not read the full text of those pages, so confirm the exact package versions on the Red Hat pages for your release.
How to check if you're exposed
On a Red Hat style system, list the installed server package and look in its changelog for the CVE id:
rpm -q xorg-x11-server-Xorg
rpm -q --changelog xorg-x11-server-Xorg | grep CVE-2026-34000
If the changelog line is missing, the package does not carry the fix. On other distributions, search the package changelog or the distribution's security tracker for the id.
Then ask who can connect to the X server. The record says a connection to the server is enough, locally or remotely. Systems that run X for remote desktops or shared workstations matter most.
What to do now
- List the hosts that run an X.Org X server, including shared workstations and remote desktop servers.
- Check each one for the distribution package that references CVE-2026-34000.
- Install the updated package and restart the X server or the display manager.
- Confirm TCP listening for X is off unless you truly need it, and restrict who can connect.
- Record any hosts that cannot be updated and limit who can log in to them.
Why it matters
The weakness is CWE-125, an out-of-bounds read. Code that handles XKB geometry data read past the end of a buffer, which can return uninitialized memory to the caller or take the server down.
The CVSS vector for this record is local, with low privileges and no user interaction. That is why the score is medium even though the description mentions remote connections. The record does not mark it as exploited and it is not on the CISA KEV list.
Quick check
Is this a remote code execution bug?
No. The record describes memory disclosure and a possible denial of service, with high confidentiality impact, no integrity impact and low availability impact.
Sources
Last reviewed: 19 October 2026.
