CVE-2026-34002 is an out-of-bounds read vulnerability in the XKB modifier map handling component of the X.Org X server, specifically in the xorg-x11-server and xwayland packages. An attacker with local access to the X11 server can send a malformed request that triggers this flaw, potentially causing information disclosure or denial of service via server crash. This vulnerability is part of a set of related issues fixed in Red Hat Enterprise Linux 9.2 and 9.4 Extended Update Support and Update Services for SAP Solutions. Red Hat has issued security advisories RHSA-2026:20547 and RHSA-2026:20555 that provide patches for these vulnerabilities.

Exploitation of this vulnerability can lead to unauthorized information disclosure or denial of service by crashing the X.Org X server. The CVSS 3.1 base score is 6.1 (medium severity) with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. There are no known exploits in the wild at this time.

Red Hat has released official security updates that address CVE-2026-34002 in the xorg-x11-server and xorg-x11-server-Xwayland packages for Red Hat Enterprise Linux 9.2 and 9.4 Extended Update Support and Update Services for SAP Solutions. Users should apply these updates promptly. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires applying the vendor-provided patches. Patch status is confirmed as fixed in the updated packages referenced in advisories RHSA-2026:20547 and RHSA-2026:20555.