Out-of-Bounds Read in X.Org Server (CVE-2026-34002) Enables Local Information Disclosure and Potential Privilege Escalation

Out-of-Bounds Read in X.Org Server (CVE-2026-34002) Enables Local Information Disclosure and Potential Privilege Escalation

What It Is – A newly disclosed out‑of‑bounds read flaw in the X.Org Server’s CheckKeyActions handling (CVE‑2026‑34002) allows a low‑privileged local attacker to read arbitrary kernel memory. The vulnerability can be chained with other bugs to achieve root‑level code execution.

Exploitability – The attack requires local code execution; no public exploit or remote‑code‑execution (RCE) is known. CVSS 6.1 (Medium) – AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L.

Affected Products – X.Org Server (all versions prior to the 2026‑06‑09 patch). The advisory lists the generic “Server” product line; any Linux‑based workstation, desktop, or embedded system that ships the X.Org display server is in scope.

TPRM Impact – Organizations that rely on third‑party SaaS, cloud‑hosted Linux workloads, or embedded devices using X.Org may inherit the flaw through their vendors. If an attacker gains a foothold on a low‑privileged process (e.g., via a separate vulnerability), they can harvest sensitive memory contents and potentially pivot to full system compromise, jeopardizing data confidentiality and service integrity across the supply chain.

Recommended Actions –

1. Verify the X.Org Server version on all assets; prioritize systems exposing a graphical stack.
2. Apply the vendor‑supplied patch (commit f056ce1c) immediately.
3. For environments where patching is delayed, mitigate by disabling X.Org where not required or restricting execution of untrusted code.
4. Review existing low‑privilege code execution vectors (e.g., container escape, user‑space exploits) and harden them.
5. Update third‑party risk registers to reflect the new vulnerability and communicate remediation status to vendors.

Source: Zero Day Initiative Advisory ZDI‑26‑336