CVE-2026-34000 Details

An out-of-bounds read vulnerability has been identified in the X.Org X server, specifically within the XKB geometry processing. The issue arises in the 'CheckSetGeom()' and 'XkbAddGeomKeyAlias' functions, where improper bounds checking allows an attacker to read uninitialized or out-of-bounds memory. This vulnerability can be exploited by an attacker with a connection to the X11 server, either locally or remotely, without user interaction. The exploitation could lead to the disclosure of sensitive memory contents or cause a denial-of-service by crashing the server.

To mitigate this vulnerability, restrict access to the X11 server. On systems where a graphical environment is not needed, consider disabling the X server by setting the default system target to multi-user mode. For systems that require the X server, ensure X11 forwarding is disabled in SSH configurations unless explicitly needed, and restrict direct X11 connections to trusted users and networks using firewall rules. If changes are made to the SSH configuration, the 'sshd' service must be restarted. A system reboot is required if the default system target is changed.