AZL-111172: CVE-2026-109088 affecting package libXtst 1.2.4-1

Q: Which systems are realistically exposed to this issue?

Systems are exposed if they run an X client that uses libXtst's parse_reply_call_callback function and communicate with a malicious X server. The affected behavior applies to libXtst versions before 1.2.6.

Q: What does an attacker need to exploit the flaw?

An attacker needs to control or operate a malicious X server capable of sending malformed RECORD EnableContext replies to a vulnerable X client.

Q: What is the impact of successful exploitation?

The vulnerable X client can enter an endless loop, resulting in a denial-of-service condition for that client.

Q: How can I determine whether an installed package is affected?

Check the installed libXtst version. Versions before 1.2.6 are affected; the reported package version is 1.2.4-1.

Published Oct 27, 2026

Updated

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop.

Affected Software

1 affected component

azure-linux/libxtst<=1.2.4-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libXtst to a version that resolves this vulnerability.
Fixed in 1.2.6

Event History

Oct 27, 2026

Advisory Published

via OSV·05:16 PM

Data Sourced

via OSV·05:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-109088

Frequently Asked Questions

Which systems are realistically exposed to this issue?

Systems are exposed if they run an X client that uses libXtst's parse_reply_call_callback function and communicate with a malicious X server. The affected behavior applies to libXtst versions before 1.2.6.

What does an attacker need to exploit the flaw?

An attacker needs to control or operate a malicious X server capable of sending malformed RECORD EnableContext replies to a vulnerable X client.

What is the impact of successful exploitation?

The vulnerable X client can enter an endless loop, resulting in a denial-of-service condition for that client.

How can I determine whether an installed package is affected?

Check the installed libXtst version. Versions before 1.2.6 are affected; the reported package version is 1.2.4-1.

AZL-111172: CVE-2026-109088 affecting package libXtst 1.2.4-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are realistically exposed to this issue?

What does an attacker need to exploit the flaw?

What is the impact of successful exploitation?

How can I determine whether an installed package is affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are realistically exposed to this issue?

What does an attacker need to exploit the flaw?

What is the impact of successful exploitation?

How can I determine whether an installed package is affected?