CVE-2026-34002 is a medium severity (CVSS 6.1) out-of-bounds read in the X.Org X server, in XKB modifier map handling. A malformed request can expose memory or crash the server. The record gives no upstream fixed version, so install your distribution's updated X server package.
What's affected
The record lists the X.Org X server and Red Hat Enterprise Linux. The flaw is in how the XKB (X Keyboard Extension) modifier map is handled when a client sends a malformed request.
No upstream fixed version is stated in the record. Red Hat references errata such as RHSA-2026:20547, RHSA-2026:20555 and RHSA-2026:20561. I could not read the erratum text, so check the Red Hat page for your release to learn the package version that carries the fix.
How to check if you're exposed
On a Red Hat style system:
rpm -q xorg-x11-server-Xorg
rpm -q --changelog xorg-x11-server-Xorg | grep CVE-2026-34002
A matching changelog line means the vendor package includes the fix. No match means it does not.
This CVE was published on the same day as CVE-2026-34000, another XKB read flaw in the same server, so one package update will likely cover both. Confirm in the advisory rather than assuming.
What to do now
- Inventory the hosts that run an X.Org X server.
- Check each package changelog for CVE-2026-34002 and for the related CVE-2026-34000.
- Install the updated package and restart the display manager or X server.
- Limit who can connect to the X server, and keep network listening off where you can.
- Track hosts that cannot be patched yet.
Why it matters
The record lists CWE-805, buffer access with an incorrect length value. The server trusts a length from the request and reads beyond the intended boundary. The result is either an information leak or a crash.
The score is medium because the vector is local with low privileges required. The record does not mark the issue as exploited, and it is not on the CISA KEV list.
Quick check
Do I need two separate updates for the two XKB CVEs?
Probably not, since both affect the same server, but check the vendor advisory for your release to see whether one package covers both.
Sources
Last reviewed: 19 October 2026.
