CVE-2026-34000 — CVE & Security Advisory Radar

🎯 CVE-2026-34000 MEDIUM 6.1 🔥 EPSS 49% 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2026-34000 | A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crash

A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.

Klassifikation & Betroffenheit:

Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION patch: 0:1.1.0-25.el6_10.16Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support patch: 0:1.11.0-8.el8_4.15Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions patch: 0:1.20.11-18.el8_8Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions patch: 0:21.1.3-5.el9_0Red Hat Enterprise Linux 9.4 Extended Update Support patch: 0:1.20.11-28.el9_4Red Hat Enterprise Linux 8.6 Telecommunications Update Service patch: 0:1.20.11-7.el8_6Red Hat Enterprise Linux 9.6 Extended Update Support patch: 0:1.14.1-10.el9_6Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions patch: 0:1.20.11-20.el9_2

Improper Control of Generation of Code ('Code Injection') 🎯 Medium

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

🛡️ Empfohlene Mitigation: Refactor your program so that you do not have to dynamically generate code.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-35 · Leverage Executable Code in Non-Executab… (Very High) CAPEC-77 · Manipulating User-Controlled Variables (Very High) CAPEC-242 · Code Injection (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1027.006 · Obfuscated Files or Information: H… T1027.009 · Obfuscated Files or Information: E… T1564.009 · Hide Artifacts: Resource Forking

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-18621 7.6 CVE-2026-19387 7.6 CVE-2026-16313 7.6 CVE-2026-56208 7.6 CVE-2026-53705 7.6

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 05/2026

Heute 07.09.

CVSS-Vektor-Analyse: 6.1

AV · Angriffsvektor Lokal

AC · Komplexität Gering

PR · Privilegien Gering

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Keine

A · Verfügbarkeit Gering

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Veröffentlicht:05.05.2026

Aktualisiert:08.06.2026 03:30

Assigner (CNA):redhat

EUVD-ID:EUVD-2026-27341

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-06
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

6.1 MEDIUM

🇪🇺 EUVD

EPSS

49%

CVE-2026-34000 💻 Lokal 🔑 Geringe Nutzerrechte nötig

Red Hat

CVE-2026-34000 | A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crash

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

05.05.2026

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub