This advisory covers five distinct vulnerabilities in the X.Org X server (xorg-x11-server) affecting Red Hat Enterprise Linux 7 Extended Lifecycle Support. The issues include CVE-2026-33999 (denial of service via integer underflow in XKB compatibility map handling), CVE-2026-34000 (information disclosure and denial of service via out-of-bounds read in XKB geometry processing), CVE-2026-34001 (use-after-free leading to server crash and potential memory corruption), CVE-2026-34002 (information disclosure or denial of service via out-of-bounds read in XKB modifier map handling), and CVE-2026-34003 (information exposure and denial of service via out-of-bounds memory access). These vulnerabilities impact the low-level graphical interface functionality provided by the X.Org server and its xwayland component. Red Hat has issued security updates to fix these vulnerabilities in the affected packages for Red Hat Enterprise Linux 7 ELS.

Successful exploitation of these vulnerabilities could result in denial of service conditions causing the X server to crash, potential memory corruption, and unauthorized disclosure of information through out-of-bounds memory reads. The CVSS vector for CVE-2026-33999 indicates high impact on confidentiality, integrity, and availability with local attack vector and low complexity. These vulnerabilities affect the stability and security of graphical user interfaces relying on the X.Org server, potentially disrupting user sessions and exposing sensitive data.

Red Hat has released security updates for the xorg-x11-server packages in Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these vulnerabilities. Users should apply the updates provided in advisory RHSA-2026:20590 as soon as possible. Detailed update instructions are available at https://access.redhat.com/articles/11258. No indication of alternative mitigations or workarounds is provided; applying the official patches is the recommended remediation.