ALSA-2026:91365: Important: libX11 security update
The libX11 packages contain the core X11 protocol client library.
Security Fix(es):
libX11: libX11: Heap-based buffer overflow via malicious X server (CVE-2026-88806)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/libX11to a version that resolves this vulnerability.Fixed in 1.8.12-1.el9_8.1 - Upgrade
Upgrade
almalinux/libX11-commonto a version that resolves this vulnerability.Fixed in 1.8.12-1.el9_8.1 - Upgrade
Upgrade
almalinux/libX11-develto a version that resolves this vulnerability.Fixed in 1.8.12-1.el9_8.1 - Upgrade
Upgrade
almalinux/libX11-xcbto a version that resolves this vulnerability.Fixed in 1.8.12-1.el9_8.1
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
An attacker must be able to present a malicious X server to a libX11 client. The flaw is a heap-based buffer overflow triggered through the X11 protocol client library.
Which installed packages should be reviewed for exposure?
Review installations of almalinux/libx11, almalinux/libx11-common, almalinux/libx11-devel, and almalinux/libx11-xcb. Systems using libX11 to connect to X servers are the relevant exposure surface.
How can I determine whether this advisory applies to my system?
Check whether any of the listed AlmaLinux libX11 packages are installed, then compare their installed package versions with the fixed versions provided by the applicable AlmaLinux security update. The supplied data does not include the fixed version numbers.