====================================================================== X.Org Security Advisory: October 16, 2026
Issues in X.Org X client libraries prior to libX11 1.8.14, libXi 1.8.4, libXpm 3.5.20, libXrender 0.9.13, libXtst 1.2.6 ====================================================================== Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for in * libX11 1.8.14 * libXi 1.8.4 * libXpm 3.5.20 * libXrender 0.9.13 * libXtst 1.2.6 ======================================================================== libX11 - 4 CVEs ======================================================================== For those considering cherry-picking the fixes, note that libX11 1.8.14 also includes additional code hardening fixes without CVEs assigned that you may also want to consider. * CVE-2026-88806: Out-of-bounds write vulnerability in libX11's XKB (X Keyboard Extension) action parser. A malicious server could send a XkbGetMap reply with keycode values exceeding max_keycode + 1, causing a write past the end of the allocated array during reply handling. Fixed in: libX11 1.8.14 Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/6d4432b13 Found by: Adam Bedard working with TrendAI Zero Day Initiative (ZDI-CAN-32061) * CVE-2026-94283: Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser. A malicious or compromised XIM server can send a crafted XIM_OPEN_REPLY message with inconsistent nested attribute lengths, causing the client to read past the end of the received packet buffer during parsing. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 6.5 (MEDIUM) Fixed in: libX11 1.8.14 Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/f263bbca2 Found by: Aisle Research (AISLE-Report-PSIRTSUPT-15963) * CVE-2026-94284: Out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser. A malicious XIM server can send a crafted XIM_REGISTER_TRIGGERKEYS message with oversized inner on-keys/off-keys length fields, causing the client to read past the received buffer during memcpy() and crash. CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 5.5 (MEDIUM) Fixed in: libX11 1.8.14 Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/924fc91f0 Found by: Aisle Research (AISLE-Report-PSIRTSUPT-16671) * CVE-2026-94285: Out-of-bounds read in libX11's byte-oriented codeset parser. When the last byte of input is a valid lead byte for a multi-byte locale (e.g. GBK, Big5), byteM_parse_codeset() reads past the caller-provided buffer while matching the second byte range. CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L — 5.3 (MEDIUM) Fixed in: libX11 1.8.14 Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/797eaf0bd Found by: Aisle Research (AISLE-Report-PSIRTSUPT-16718) ======================================================================== libXi - 9 CVEs ======================================================================== For those considering cherry-picking the fixes, note that libXi 1.8.4 also includes additional code hardening fixes without CVEs assigned that you may also want to consider. * CVE-2026-93541: Out-of-bounds read in libXi's XQueryDeviceState(). XQueryDeviceState() trusts the num_valuators value from a ValuatorClass reply without checking it fits in the declared class length, enabling an OOB read and client crash via a forged reply. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 6.5 (MEDIUM) Fixed in: libXi 1.8.4 Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/9a5f8636b Found by: Aisle Research (AISLE-Report-PSIRTSUPT-13253) * CVE-2026-93542: Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes(). Malicious XIQueryDevice replies or XI_DeviceChanged events with inconsistent class lengths can drive the parser past the received buffer and crash the client. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 6.5 (MEDIUM) Fixed in: libXi 1.8.4 Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/59f8dece8 Found by: Aisle Research (AISLE-Report-PSIRTSUPT-13600) * CVE-2026-93543: Out-of-bounds read in libXi's XI2 class parser. A malicious X server can send forged XI_DeviceChanged events (or XIQueryDevice replies) with inconsistent class metadata. An overlong num_classes, zero or oversized per-class length, or button/key counts exceeding the class bytes causing the size_classes() and copy_classes() to walk past the event/reply buffer and crash the client. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 5.9 (MEDIUM) Fixed in: libXi 1.8.4 Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f885619bb Found by: Aisle Research (AISLE-Report-PSIRTSUPT-13717) * CVE-2026-93544: Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing. Class parsing helpers size_classes()/copy_classes() and the XIQueryDevice() caller walk wire data using data provided by the Xserver (length, num_buttons and num_keycodes) without bounds checking, enabling OOB reads and client crashes via malformed replies. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 6.5 (MEDIUM) Fixed in: libXi 1.8.4 Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/e2ec4a1c8 Found by: Aisle Research (AISLE-Report-PSIRTSUPT-14043) * CVE-2026-93545: Out-of-bounds read in libXi's XListInputDevices() A malicious server can set a name length byte that exceeds the remaining reply bytes, causing memcpy() to read past the buffer when parsing device name strings from a ListInputDevices reply. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L — 5.4 (MEDIUM) Fixed in: libXi 1.8.4 Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/2e5ecd187 Found by: Aisle Research (AISLE-Report-PSIRTSUPT-14711) * CVE-2026-94281: Out-of-bounds read in libXi's XListInputDevices() class parsing. SizeClassInfo() validates each class record's length against the original buffer size but never decrements it, allowing a sequence of individually-valid class lengths to cumulatively advance past the buffer. ParseClassInfo() then walks the same records without any bounds checking. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L — 5.4 (MEDIUM) Fixed in: libXi 1.8.4 Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/1d5813ba0 Found by: Aisle Research (AISLE-Report-PSIRTSUPT-14718) * CVE-2026-94282: Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion. A malicious X server can send a crafted XI2 Enter, Leave, FocusIn, or FocusOut GenericEvent with a small outer length but an oversized buttons_len field, causing wireToEnterLeave() to copy data past the end of the received event buffer. CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H — 6.1 (MEDIUM) Fixed in: libXi 1.8.4 Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/8caed97a3 Found by: Aisle Research (AISLE-Report-PSIRTSUPT-15083) * CVE-2026-109089: libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow XGetDeviceControl() sizes the client buffer from the server's d->control and fills it from the caller's control argument. A hostile server can answer DEVICE_RESOLUTION with a small fixed-size control type so allocation is tiny while the fill still walks an unbounded DEVICE_RESOLUTION valuator list, overflowing the heap. Fixed in: libXi 1.8.4 Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f7836d0a0 Found by: Adam Bedard, Security Researcher. * CVE-2026-109090: libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow DEVICE_ENABLE has a fill path in XGetDeviceControl() but no size arm, so allocation uses the wire length (8 bytes) while the fill writes a full XDeviceEnableState (12–16 bytes), overflowing the heap. Fixed in: libXi 1.8.4 Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b6 Found by: Adam Bedard, Security Researcher. ======================================================================== libXpm - 1 CVE ======================================================================== * CVE-2026-94287: Denial of service via unsigned underflow in libXpm's write path. A crafted 0x0 XPM passes the parser's dimension checks and, when serialized through WritePixels(), causes an unsigned underflow in the row loop bound (height - 1 wraps to UINT_MAX), resulting in prolonged CPU use and continuous output growth. CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — 5.5 (MEDIUM) Fixed in: libXpm 3.5.20 Fix: https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/58eb875b7 Found by: Aisle Research (AISLE-Report-PSIRTSUPT-14424) ======================================================================== libXrender - 1 CVE ======================================================================== * CVE-2026-88807: Out-of-bounds read in libXrender's XRenderQueryFormat reply parser. A malicious server could reply to XRenderQueryFormat with a numSubpixels count greater than the number of screens, causing an OOB write into screen->subpixel which was allocated using numScreens. Fixed in: libXrender 0.9.13 Fix: https://gitlab.freedesktop.org/xorg/lib/libxrender/-/commit/0564bce54 Found by: Adam Bedard working with TrendAI Zero Day Initiative (ZDI-CAN-32093) ======================================================================== libXtst - 2 CVEs ======================================================================== * CVE-2026-94286: Out-of-bounds read in libXtst's RECORD reply parser. A malicious Xserver can send a crafted RECORD reply where the inner element's datum_bytes exceeds the actual reply buffer size, causing the RECORD callback to receive a pointer/length pair that extends past the allocated buffer. When the callback reads the advertised payload, it triggers an out of bounds read that can crash the client or expose adjacent process memory. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H — 7.1 (HIGH) Fixed in: libXtst 1.2.6 Fix: https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/b84737d84 Found by: Aisle Research (AISLE-Report-PSIRTSUPT-16762) * CVE-2026-109088: libXtst RECORD EnableContext Reply Endless Loop parse_reply_call_callback() advances through RECORD EnableContext reply elements by datum_bytes. A zero-sized XRecordFromClient (BIG-REQUESTS length 0) or an undefined category byte leaves datum_bytes at 0 while bytes remain, so the loop never terminates and the application callback is invoked forever with empty data. A malicious or compromised X server answering EnableContext can hang XRecordEnableContext() (sync) or livelock Xlib reply processing (async). Fixed in: libXtst 1.2.6 Fix: https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/ac60f5f47 Found by: Kaya Emre Arikan. ======================================================================== X.Org thanks all of those who reported and fixed these issues, and those who helped with the review and release of this advisory and these fixes. The X.Org security team would like to take this opportunity to remind X client authors that current best practices suggest separating code that requires privileges from the GUI, to reduce the risk of issues like these. -- -Alan Coopersmith- [email protected] X.Org Security Response Team - [email protected]
signature.asc
Description: PGP signature
