CVE-2026-109088

MediumCVSS 6.5

Published: 27/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

20th percentile - higher than 20% of all known CVEs

Summary

A malicious X server could send malformed RECORD EnableContext replies that cause an X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter an endless loop.

Risk Assessment

This can lead to hangs or denial of service in X client applications using libXtst, affecting workstation availability.

Recommendation

Update libXtst to version 1.2.6 or later and limit trust in the X servers that clients connect to.

Other vulnerabilities in libXtst

CVE-2026-94286High
An out-of-bounds read exists in libXtst's RECORD reply parser in versions before 1.2.6. A malicious X server could exploit this to crash attached X clients.

Original NVD description (English source)

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS