ZDI-26-906: X.Org Server libX11 XkbGetMap Reply Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published Nov 10, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of X.Org Server. User interaction is required to exploit this vulnerability in that the target must connect to a malicious X11 server. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-88806.

Event History

Nov 10, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must cause the target to connect to a malicious X11 server. Exploitation requires user interaction because the target must initiate that connection.

Who is exposed to remote code execution?

Affected X.Org Server installations using the vulnerable libX11 XkbGetMap reply handling are exposed when a user connects to an attacker-controlled X11 server.

How can I determine whether this vulnerability applies to an incident or asset?

Look for affected X.Org Server installations and evidence that a user connected to an untrusted or malicious X11 server. The issue is tracked as CVE-2026-88806.

ZDI-26-906: X.Org Server libX11 XkbGetMap Reply Heap-based Buffer Overflow Remote Code Execution Vulnerability

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

Who is exposed to remote code execution?

How can I determine whether this vulnerability applies to an incident or asset?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Who is exposed to remote code execution?

How can I determine whether this vulnerability applies to an incident or asset?