CVE-2026-109088: libXtst RECORD EnableContext Reply Endless Loop
A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libXtstto a version that resolves this vulnerability.Fixed in 1.2.6
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
X clients that use libXtst's RECORD extension handling and the parse_reply_call_callback function are exposed when they communicate with a malicious X server. The affected versions are libXtst versions before 1.2.6.
What does an attacker need to exploit it?
An attacker needs to operate or control an X server that the vulnerable client connects to, and send malformed RECORD EnableContext replies. No client-side privileges are required, but user interaction is required for the client to connect to that server.
What is the impact of successful exploitation?
The affected X client can enter an endless loop, resulting in a denial of service for that client. The provided data does not indicate confidentiality or integrity impact.