An integer underflow in the X.Org X server's XKB compatibility map handling can be exploited by an attacker with local or remote X11 server access to cause a buffer read overrun. This vulnerability can lead to memory corruption issues including denial of service or potentially more severe impacts. The issue affects Red Hat Enterprise Linux 10 and is tracked as CVE-2026-33999 with a CVSS score of 7.8 (high severity). Red Hat has issued an official security advisory and released patches in the xorg-x11-server-Xwayland package to remediate this vulnerability.

Successful exploitation of this vulnerability can cause memory-safety violations such as denial of service or other severe impacts on systems running the vulnerable X.Org X server on Red Hat Enterprise Linux 10. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Red Hat has released an official security update for the xorg-x11-server-Xwayland package in Red Hat Enterprise Linux 10 that addresses CVE-2026-33999. Users should apply the provided update as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.