RLSA-2026:98604: Important: libXtst security update
X.Org X11 libXtst runtime library
Security Fix(es):
libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser (CVE-2026-94286)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/libXtstto a version that resolves this vulnerability.Fixed in 0:1.2.4-8.el10_2.1 - Upgrade
Upgrade
rocky-linux/libXtst-develto a version that resolves this vulnerability.Fixed in 0:1.2.4-8.el10_2.1 - Upgrade
Upgrade
rocky-linux/libXtst-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.2.4-8.el10_2.1 - Upgrade
Upgrade
rocky-linux/libXtst-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.2.4-8.el10_2.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation is network-accessible, requires low attack complexity, no privileges, and user interaction. The available data does not specify the exact interaction required or the protocol path used.
What is the likely impact if exploitation succeeds?
The described issue is a denial of service caused by an out-of-bounds read in the RECORD reply parser. The CVSS vector indicates high availability impact and low confidentiality impact, with no integrity impact.
Which Rocky Linux packages are covered by this update?
The advisory covers rocky-linux/libxtst, rocky-linux/libxtst-devel, rocky-linux/libxtst-debuginfo, and rocky-linux/libxtst-debugsource.