CVE-2026-34002

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
May 5, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-340037.8A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X CVE-2026-340058.8In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters CVE-2026-340069.3A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability cCVE-2026-340076.9An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackCVE-2026-340088.5An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gainCVE-2026-340098.4An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an adminiCVE-2026-34016.6A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipuCVE-2026-340148.4An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gaiCVE-2026-340156.5A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit tCVE-2026-340189.8An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the pCVE-2026-340195.3When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the TraffCVE-2026-34024.8A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0. This vulnerability affects unknown code
CVE-2026-34002: Critical severity, CVSS 9.1 | Vulnix