This advisory covers five distinct vulnerabilities in the xorg-x11-server-Xwayland package for Red Hat Enterprise Linux 10.0 EUS. The flaws include: CVE-2026-33999, an integer underflow causing denial of service in XKB compatibility map handling; CVE-2026-34000, out-of-bounds read leading to information disclosure and denial of service in XKB geometry processing; CVE-2026-34001, a use-after-free vulnerability causing server crashes and potential memory corruption; CVE-2026-34002, out-of-bounds read causing information disclosure or denial of service in XKB modifier map handling; and CVE-2026-34003, out-of-bounds memory access resulting in information exposure and denial of service. These vulnerabilities impact the Xwayland server component that enables running X clients under Wayland. Red Hat has issued updated packages to remediate these issues.

Successful exploitation of these vulnerabilities can lead to denial of service conditions causing the X server to crash or become unresponsive. Some vulnerabilities also allow information disclosure through out-of-bounds memory reads. The use-after-free flaw may cause memory corruption, potentially destabilizing the system. These impacts affect systems running the vulnerable Xwayland versions on supported Red Hat Enterprise Linux 10.0 Extended Update Support architectures.

Red Hat has released updated xorg-x11-server-Xwayland packages that address these vulnerabilities. Users and administrators should apply the security update as detailed in Red Hat advisory RHSA-2026:20563 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended and effective mitigation. No additional vendor-recommended mitigations or workarounds are indicated.