CVE-2026-94286

HighCVSS 7.1

Published: 28/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

7th percentile - higher than 7% of all known CVEs

Summary

An out-of-bounds read exists in libXtst's RECORD reply parser in versions before 1.2.6. A malicious X server could exploit this to crash attached X clients.

Risk Assessment

An attacker controlling an X server can crash X clients in the organization, disrupting graphical environments and X11-dependent applications.

Recommendation

Upgrade libXtst to version 1.2.6 or later on all workstations and servers using X11.

Other vulnerabilities in libXtst

CVE-2026-109088Medium
A malicious X server could send malformed RECORD EnableContext replies that cause an X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter an endless loop.

Original NVD description (English source)

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS