X.Org Server: Root LPE via XkbSetCompatMap;…

CVE-2026-33999 in X.Org Server enables local privilege escalation to root. Discovered by ZDI, the fix follows a coordinated disclosure process.

On June 9, 2026, advisory ZDI-26-333 disclosed an integer underflow vulnerability in XkbSetCompatMap, a core function of the X.Org Server. This flaw allows an attacker with low-privileged code execution to escalate their rights to root. The vulnerability was reported to X.Org on December 18, 2025. CVE-2026-33999 carries a CVSS 3.1 score of 7.8 (High), with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Key Takeaways

Integer underflow in XkbSetCompatMap: A lack of proper user data validation causes an arithmetic underflow before memory writes.
Precondition: The attacker must already have the ability to execute low-privileged code on the target system.
Timeline: Approximately 174 days elapsed between the initial report (December 18, 2025) and coordinated disclosure (June 9, 2026).
Remediation: A patch is available from X.Org; Red Hat has issued multiple RHSA advisories covering various RHEL versions.

Technical Breakdown: Advisory Facts

The X.Org Server handles XkbSetCompatMap requests to configure the XKB keyboard compatibility map. Advisory ZDI-26-333 states verbatim:

"The specific flaw exists within the handling of XkbSetCompatMap requests. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory."

The advisory further notes: "An attacker can leverage this vulnerability to escalate privileges and execute code in the context of root." The precondition is explicit: "An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability."

Analysis: The arithmetic underflow in XKB compatibility map management provides a privilege escalation path within the graphics server's input subsystem. The CVSS vector confirms its local nature (AV:L, AC:L, PR:L, UI:N). No user interaction is required, but local access with limited privileges is a mandatory prerequisite.

The Disclosure Chain: ZDI, X.Org, CVE, and Red Hat

Jan-Niklas Sohn, a researcher with TrendAI’s Zero Day Initiative, discovered the flaw. The CVE-2026-33999 record notes: "Red Hat would like to thank Jan-Niklas Sohn (TrendAI Zero Day Initiative) for reporting this issue."

The ZDI timeline shows the report was submitted on December 18, 2025, with the public release on June 9, 2026. This 174-day window represents a coordinated disclosure: the researcher grants the vendor exclusivity in exchange for time to develop and distribute a fix. X.Org has issued the update, and Red Hat has propagated multiple RHSAs to cover affected RHEL versions.

Editorial Caution on CVE Discrepancies: The CVE-2026-33999 record describes the flaw as follows: "A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun." This description expands the attack surface to "remote X11 server access," whereas advisory ZDI-26-333 specifically limits the scope to "local attackers" with a low-privilege code execution precondition. This discrepancy is a point to monitor; the ZDI classification as a local LPE is more stringent than the CVE description.

The CVE record also mentions "denial of service via integer underflow in xkb compatibility map handling" alongside privilege escalation. This description is slightly different, presenting a medium risk to source consistency.

The ZDI advisory confirms that "X.Org has issued an update to correct this vulnerability," though it does not detail specific commits or patches. While the CVE record links to Red Hat advisories, it does not list the precise versions of X.Org Server affected. Furthermore, the documentation does not specify if a public proof-of-concept exists or if the vulnerability was exploited in the wild during the private disclosure period.

Why X11 Remains a Critical Vector

X.Org Server is the reference implementation of the X11 protocol, the long-standing graphical standard for Unix and Linux. While the X11 protocol is approximately 40 years old, this does not imply the bug itself shares that longevity. The graphics server remains ubiquitous on Linux workstations, terminal servers, and virtualized desktop infrastructures.

The XkbSetCompatMap function belongs to the XKB (X Keyboard Extension) subsystem, which manages hardware keyboard input. A defect in this layer converts any initial compromise—regardless of the vector—into full root escalation, provided the attacker meets the low-privileged code execution requirement.

The available documentation does not detail the nature of data exposed during exploitation, nor does it provide alternative mitigations or containment countermeasures.

Remediation Steps

Apply the X.Org update issued for this vulnerability immediately.
Review Red Hat RHSA advisories related to CVE-2026-33999 to identify affected RHEL versions and available fixes.

The current brief does not specify the patch status for non-Red Hat distributions. Remediation actions are limited to the elements confirmed in the documentation: the X.Org patch and the issued Red Hat advisories.

The Coordinated Disclosure Model

"This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server." — ZDI-26-333 advisory

The 174-day coordinated disclosure period illustrates the trade-off between remediation time and potential exposure. The model functioned as intended: X.Org received the report, developed the patch, and released the update before the advisory went public. The private period left the vulnerable code in circulation, but with knowledge restricted to the researcher, the vendor, and any actors with access to non-public information.

Source Limitations: This report is primarily based on advisory ZDI-26-333 and the CVE-2026-33999 record. No additional primary sources with converging technical details are currently available. Information originates from a single structured source (ZDI) with corroboration from the official CVE record.

Information has been verified against cited sources and is current as of the time of publication.

Sources

Sources and references