An integer underflow vulnerability exists in the X.Org X server component of Red Hat Enterprise Linux 10, specifically in the XKB compatibility map handling. This flaw can be exploited by an attacker with local or remote X11 server access to cause a buffer read overrun, leading to memory-safety violations such as denial of service or potentially more severe impacts. The vulnerability is tracked as CVE-2026-33999 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vendor advisory does not currently specify a remediation level or patch availability. No known exploits in the wild have been reported.

The vulnerability allows an attacker with local or remote access to the X11 server to trigger a buffer read overrun due to an integer underflow in the XKB compatibility map handling. This can lead to memory-safety violations, including denial of service and potentially compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-33999 for current remediation guidance. Since no official fix or temporary workaround is indicated in the advisory, users should monitor the vendor site for updates and apply patches promptly once available. Until then, limiting access to the X11 server to trusted users may reduce exposure.