Live › vulnerability › CVE-2026-109088
Go to dashboardA malicious X server can send malformed RECORD EnableContext replies to an X client using libXtst before 1.2.6. The client then enters an endless loop, which stalls or hangs the program.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Systems with X11 clients that use libXtst's RECORD extension against an X server that may be untrusted, such as remote X forwarding or connecting to a display on another host. A local desktop talking only to its own trusted X server is less exposed. The sources do not describe a default configuration that exposes it.
No product ranges from the sources yet.
pkg-config --modversion xtst or dpkg -l libxtst6, and check whether it is below 1.2.6.1.2.6 or later through your OS package manager.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.
This page as .md · .json · in your agent: get_signal("CVE-2026-109088")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.