CVE-2026-94286: Out-of-bounds read in libXtst's RECORD reply parser
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.2.6-1 - Upgrade
Upgrade
libXtstto a version that resolves this vulnerability.Fixed in 1.2.6
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
X clients that use libXtst's RECORD functionality and connect to a malicious X server are exposed. The issue affects libXtst versions before 1.2.6.
What does an attacker need to exploit it?
An attacker needs to operate or cause a client to connect to a malicious X server that sends a crafted RECORD reply. No privileges on the affected client are required, but user interaction is required according to the supplied vector.
What is the practical impact?
A malicious X server can trigger an out-of-bounds read and crash attached X clients. The provided information describes availability impact and does not state that code execution is possible.