This advisory covers three security vulnerabilities in the xorg-x11-server-Xwayland package on Red Hat Enterprise Linux 8. CVE-2026-33999 is an integer underflow in XKB compatibility map handling that can cause denial of service. CVE-2026-34001 is a use-after-free vulnerability that may lead to server crashes and potential memory corruption. CVE-2026-34003 involves out-of-bounds memory access resulting in information exposure and denial of service. Red Hat has issued updated packages to fix these issues across multiple architectures and product variants. The vulnerabilities relate to memory handling errors in the X.Org X server component that runs X clients under Wayland.

Successful exploitation of these vulnerabilities could cause denial of service conditions by crashing the X.Org X server or lead to memory corruption and information exposure. This could disrupt graphical session availability and potentially expose sensitive information handled by the X server. The severity is rated as high due to the potential for service disruption and memory corruption. However, there are no reports of active exploitation in the wild.

Red Hat has released updated xorg-x11-server-Xwayland packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 8 versions should apply the security update as described in Red Hat advisory RHSA-2026:11656. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No additional mitigations are specified or required beyond installing the update.