CVE-2026-33999

HighCVSS 7.8/10Last modified Jul 15, 2026

Description

A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-191

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Apr 23, 2026
Last modified: Jul 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-34009.8A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /gofor CVE-2026-340009.1A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `Check CVE-2026-340017.8A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within th CVE-2026-340029.1A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handl CVE-2026-340037.8A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X CVE-2026-340058.8In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters CVE-2026-340069.3A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability c CVE-2026-340076.9An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attack CVE-2026-340088.5An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gain CVE-2026-340098.4An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an admini CVE-2026-34016.6A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipu CVE-2026-340148.4An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gai