DEBIAN-CVE-2026-109088: Medium severity debian/libxtst vulnerability

Published Oct 27, 2026

Updated

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop.

Affected Software

3 affected components

debian/libxtst*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libXtst to a version that resolves this vulnerability.
Fixed in 1.2.6

Event History

Oct 27, 2026

CVE Published

via OSV·05:16 PM

Data Sourced

via OSV·05:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

X clients that use libXtst's parse_reply_call_callback function and connect to a malicious X server are exposed. The affected libXtst versions are those before 1.2.6.

What does an attacker need to exploit it?

An attacker needs to operate or control an X server that the target client connects to. Exploitation also requires user interaction, as reflected by the UI:R vector.

What is the impact of successful exploitation?

Malformed RECORD EnableContext replies can cause the affected X client to enter an endless loop, resulting in denial of service. The provided vector indicates no confidentiality or integrity impact.