---
id: "CVE-2026-109088"
kind: "vulnerability"
aliases: ["CVE-2026-109088"]
title: "libXtst: malformed X server reply causes client endless loop"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "libxtst", "linux", "self-hosted", "x11"]
not_affected_if: ["libxtst-1.2.6-or-later", "trusted-x-server-only"]
published_at: "2026-10-27T17:16:57+00:00"
first_seen_at: "2026-10-27T17:32:45+00:00"
updated_at: "2026-10-27T17:34:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109088", "first_seen_at": "2026-10-27T17:32:45+00:00"}]
---

# libXtst: malformed X server reply causes client endless loop

A malicious X server can send malformed RECORD EnableContext replies to an X client using libXtst before 1.2.6. The client then enters an endless loop, which stalls or hangs the program.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the installed libXtst version, for example with `pkg-config --modversion xtst` or `dpkg -l libxtst6`, and check whether it is below `1.2.6`.
- Check whether programs linking libXtst connect to X servers you do not control.

## Fix

- Upgrade libXtst to `1.2.6` or later through your OS package manager.

## Timeline

- 2026-10-27T17:32:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109088

## From the sources

A malicious X server could send malformed  RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_