UBUNTU-CVE-2026-109088: Medium severity ubuntu/libxtst vulnerability

Published Oct 27, 2026

Updated

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop.

Affected Software

7 affected components

ubuntu/libxtst*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libXtst to a version that resolves this vulnerability.
Fixed in 1.2.6

Event History

Oct 27, 2026

CVE Published

via OSV·05:16 PM

Data Sourced

via OSV·05:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed?

X clients using libXtst versions before 1.2.6 are affected when they communicate with a malicious X server.

What does an attacker need to exploit this issue?

The attacker needs to provide a malicious X server that sends malformed RECORD EnableContext replies to the client. The supplied vector indicates no attacker privileges are required, but user interaction is required.

How can I determine whether a client is affected?

Check the libXtst version used by the X client. Versions before 1.2.6 are affected.

UBUNTU-CVE-2026-109088: Medium severity ubuntu/libxtst vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to exploit this issue?

How can I determine whether a client is affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to exploit this issue?

How can I determine whether a client is affected?