This advisory covers three security vulnerabilities in the xorg-x11-server-Xwayland package for Red Hat Enterprise Linux 10. CVE-2026-33999 is an integer underflow in XKB compatibility map handling that can cause denial of service. CVE-2026-34001 is a use-after-free flaw that may lead to server crashes and potential memory corruption. CVE-2026-34003 involves out-of-bounds memory access resulting in information exposure and denial of service. These issues affect the Xwayland X server component, which enables running X clients under Wayland. Red Hat has released updated packages to fix these vulnerabilities across multiple supported architectures and product variants.

Successful exploitation of these vulnerabilities could cause denial of service conditions by crashing the Xwayland server or corrupting memory, potentially impacting system stability. Information exposure through out-of-bounds memory access could leak sensitive data. The use-after-free vulnerability may lead to memory corruption, which could have further security implications. However, there are no reports of active exploitation in the wild at this time.

Red Hat has released updated xorg-x11-server-Xwayland packages for Red Hat Enterprise Linux 10 and related products that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. Detailed instructions and updated packages are available in the Red Hat advisory RHSA-2026:19125 at https://access.redhat.com/errata/RHSA-2026:19125. No additional mitigation steps are indicated by the vendor advisory.