CVE-2026-94286
published 2026-09-28CVE-2026-94286: An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
PriorityP429high7.1CVSS 3.1
AVNACLPRNUIRSUCLINAH
EPSS
0.20%
10.2th percentile
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libxtst | — | — |
| ubuntu | libxtst | — | — |
| x.org | libxtst | < 1.2.6 | 1.2.6 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
vendor_ubuntu9.8CRITICAL
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libXtst vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 9.8
CVE-2016-7951 [CRITICAL] libXtst vulnerabilities
Title: libXtst vulnerabilities
Summary: Several security issues were fixed in libXtst.
It was discovered that libXtst did not properly handle certain RECORD
replies from the X server. A malicious X server could possibly use this
issue to cause libXtst clients to crash, resulting in a denial of service.
(CVE-2026-94286)
Tobias Stoeckmann discovered that libXtst did not properly handle certain
memory operations. A malicious X server could possibly use this issue to
cause libXtst to access memory out of bounds, resulting in a denial of
service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7951)
Tobias Stoeckmann discovered that libXtst did not properly handle certain
replies from the X server. A malicious X server could possibly use this
issue to cause libXtst to enter an infinite
Red Hat
libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser
vendor_redhat·2026-09-28·CVSS 7.1
CVE-2026-94286 [HIGH] CWE-125 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser
libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser
A flaw was found in libXtst. An out-of-bounds read vulnerability in the RECORD extension reply parser allows a malicious X server to cause a Denial of Service (DoS) by crashing connected client applications. Under certain conditions, this flaw may also result in limited information disclosure.
Package: libXtst (Red Hat Enterprise Linux 10) - Affected
Package: libXtst (Red Hat Enterprise Linux 6) - Affected
Package: libXtst (Red Hat Enterprise Linux 7) - Affected
Package: libXtst (Red Hat Enterprise Linux 8) - Affected
Package: libXtst (Red Hat Enterprise Linux 9) - Affected
Package: libXtst (Red Hat Hardened Images) - Affected
GHSA
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
ghsa_unreviewed·2026-09-28
CVE-2026-94286 [HIGH] CWE-126 An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser [fedora-all]
bugzilla·2026-09-29·CVSS 7.1
CVE-2026-94286 [HIGH] CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser [fedora-all]
CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
Bugzilla
CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser
bugzilla·2026-09-28·CVSS 7.1
CVE-2026-94286 [HIGH] CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser
CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
2026-09-28
Published