[<prev] [next>] [day] [month] [year] [list]
Message-ID: <d6df5e3c-1eac-4b9e-8504-d6d5354ecb90@oracle.com>
Date: Fri, 16 Oct 2026 14:53:04 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Fwd: X.Org Security Advisory: multiple security issues
in X.Org X client libraries
All five library releases are available now, see
https://lists.x.org/archives/xorg-announce/2026-October/thread.html
for links to their release announcements.
-------- Forwarded Message --------
Subject: X.Org Security Advisory: multiple security issues in X.Org X client
libraries
Date: Fri, 16 Oct 2026 12:04:10 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: xorg-announce@...ts.x.org
CC: xorg@...ts.x.org
======================================================================
X.Org Security Advisory: October 16, 2026
Issues in X.Org X client libraries prior to libX11 1.8.14,
libXi 1.8.4, libXpm 3.5.20, libXrender 0.9.13, libXtst 1.2.6
======================================================================
Multiple issues have been found in the X client library implementations
published by X.Org for which we are releasing security fixes for in
* libX11 1.8.14
* libXi 1.8.4
* libXpm 3.5.20
* libXrender 0.9.13
* libXtst 1.2.6
========================================================================
libX11 - 4 CVEs
========================================================================
For those considering cherry-picking the fixes, note that libX11 1.8.14
also includes additional code hardening fixes without CVEs assigned
that you may also want to consider.
* CVE-2026-88806:
Out-of-bounds write vulnerability in libX11's XKB (X Keyboard Extension)
action parser.
A malicious server could send a XkbGetMap reply with keycode values
exceeding max_keycode + 1, causing a write past the end of the allocated
array during reply handling.
Fixed in: libX11 1.8.14
Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/6d4432b13
Found by: Adam Bedard working with TrendAI Zero Day Initiative (ZDI-CAN-32061)
* CVE-2026-94283:
Out-of-bounds read vulnerability in libX11's XIM (X Input Method)
attribute parser.
A malicious or compromised XIM server can send a crafted XIM_OPEN_REPLY
message with inconsistent nested attribute lengths, causing the client
to read past the end of the received packet buffer during parsing.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 6.5 (MEDIUM)
Fixed in: libX11 1.8.14
Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/f263bbca2
Found by: Aisle Research (AISLE-Report-PSIRTSUPT-15963)
* CVE-2026-94284:
Out-of-bounds read vulnerability in libX11's XIM trigger-key
registration parser.
A malicious XIM server can send a crafted XIM_REGISTER_TRIGGERKEYS
message with oversized inner on-keys/off-keys length fields, causing the
client to read past the received buffer during memcpy() and crash.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 5.5 (MEDIUM)
Fixed in: libX11 1.8.14
Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/924fc91f0
Found by: Aisle Research (AISLE-Report-PSIRTSUPT-16671)
* CVE-2026-94285:
Out-of-bounds read in libX11's byte-oriented codeset parser.
When the last byte of input is a valid lead byte for a multi-byte locale
(e.g. GBK, Big5), byteM_parse_codeset() reads past the caller-provided
buffer while matching the second byte range.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L — 5.3 (MEDIUM)
Fixed in: libX11 1.8.14
Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/797eaf0bd
Found by: Aisle Research (AISLE-Report-PSIRTSUPT-16718)
========================================================================
libXi - 9 CVEs
========================================================================
For those considering cherry-picking the fixes, note that libXi 1.8.4
also includes additional code hardening fixes without CVEs assigned
that you may also want to consider.
* CVE-2026-93541:
Out-of-bounds read in libXi's XQueryDeviceState().
XQueryDeviceState() trusts the num_valuators value from a
ValuatorClass reply without checking it fits in the declared class
length, enabling an OOB read and client crash via a forged reply.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 6.5 (MEDIUM)
Fixed in: libXi 1.8.4
Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/9a5f8636b
Found by: Aisle Research (AISLE-Report-PSIRTSUPT-13253)
* CVE-2026-93542:
Out-of-bounds read in libXi's XI2 class parsing via size_classes()
and copy_classes().
Malicious XIQueryDevice replies or XI_DeviceChanged events with
inconsistent class lengths can drive the parser past the received
buffer and crash the client.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 6.5 (MEDIUM)
Fixed in: libXi 1.8.4
Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/59f8dece8
Found by: Aisle Research (AISLE-Report-PSIRTSUPT-13600)
* CVE-2026-93543:
Out-of-bounds read in libXi's XI2 class parser.
A malicious X server can send forged XI_DeviceChanged events
(or XIQueryDevice replies) with inconsistent class metadata.
An overlong num_classes, zero or oversized per-class length,
or button/key counts exceeding the class bytes causing the
size_classes() and copy_classes() to walk past the event/reply
buffer and crash the client.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 5.9 (MEDIUM)
Fixed in: libXi 1.8.4
Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f885619bb
Found by: Aisle Research (AISLE-Report-PSIRTSUPT-13717)
* CVE-2026-93544:
Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing.
Class parsing helpers size_classes()/copy_classes() and the
XIQueryDevice() caller walk wire data using data provided by the
Xserver (length, num_buttons and num_keycodes) without bounds
checking, enabling OOB reads and client crashes via malformed
replies.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 6.5 (MEDIUM)
Fixed in: libXi 1.8.4
Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/e2ec4a1c8
Found by: Aisle Research (AISLE-Report-PSIRTSUPT-14043)
* CVE-2026-93545:
Out-of-bounds read in libXi's XListInputDevices()
A malicious server can set a name length byte that exceeds the
remaining reply bytes, causing memcpy() to read past the buffer
when parsing device name strings from a ListInputDevices reply.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L — 5.4 (MEDIUM)
Fixed in: libXi 1.8.4
Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/2e5ecd187
Found by: Aisle Research (AISLE-Report-PSIRTSUPT-14711)
* CVE-2026-94281:
Out-of-bounds read in libXi's XListInputDevices() class parsing.
SizeClassInfo() validates each class record's length against the
original buffer size but never decrements it, allowing a sequence
of individually-valid class lengths to cumulatively advance past
the buffer. ParseClassInfo() then walks the same records without
any bounds checking.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L — 5.4 (MEDIUM)
Fixed in: libXi 1.8.4
Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/1d5813ba0
Found by: Aisle Research (AISLE-Report-PSIRTSUPT-14718)
* CVE-2026-94282:
Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion.
A malicious X server can send a crafted XI2 Enter, Leave, FocusIn,
or FocusOut GenericEvent with a small outer length but an oversized
buttons_len field, causing wireToEnterLeave() to copy data past the
end of the received event buffer.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H — 6.1 (MEDIUM)
Fixed in: libXi 1.8.4
Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/8caed97a3
Found by: Aisle Research (AISLE-Report-PSIRTSUPT-15083)
* CVE-2026-109089:
libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow
XGetDeviceControl() sizes the client buffer from the server's
d->control and fills it from the caller's control argument. A hostile
server can answer DEVICE_RESOLUTION with a small fixed-size control
type so allocation is tiny while the fill still walks an unbounded
DEVICE_RESOLUTION valuator list, overflowing the heap.
Fixed in: libXi 1.8.4
Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f7836d0a0
Found by: Adam Bedard, Security Researcher.
* CVE-2026-109090:
libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
DEVICE_ENABLE has a fill path in XGetDeviceControl() but no size arm,
so allocation uses the wire length (8 bytes) while the fill writes a
full XDeviceEnableState (12–16 bytes), overflowing the heap.
Fixed in: libXi 1.8.4
Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b6
Found by: Adam Bedard, Security Researcher.
========================================================================
libXpm - 1 CVE
========================================================================
* CVE-2026-94287:
Denial of service via unsigned underflow in libXpm's write path.
A crafted 0x0 XPM passes the parser's dimension checks and, when
serialized through WritePixels(), causes an unsigned underflow in the
row loop bound (height - 1 wraps to UINT_MAX), resulting in prolonged
CPU use and continuous output growth.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — 5.5 (MEDIUM)
Fixed in: libXpm 3.5.20
Fix: https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/58eb875b7
Found by: Aisle Research (AISLE-Report-PSIRTSUPT-14424)
========================================================================
libXrender - 1 CVE
========================================================================
* CVE-2026-88807:
Out-of-bounds read in libXrender's XRenderQueryFormat reply parser.
A malicious server could reply to XRenderQueryFormat with a numSubpixels
count greater than the number of screens, causing an OOB write into
screen->subpixel which was allocated using numScreens.
Fixed in: libXrender 0.9.13
Fix: https://gitlab.freedesktop.org/xorg/lib/libxrender/-/commit/0564bce54
Found by: Adam Bedard working with TrendAI Zero Day Initiative (ZDI-CAN-32093)
========================================================================
libXtst - 2 CVEs
========================================================================
* CVE-2026-94286:
Out-of-bounds read in libXtst's RECORD reply parser.
A malicious Xserver can send a crafted RECORD reply where the inner
element's datum_bytes exceeds the actual reply buffer size, causing
the RECORD callback to receive a pointer/length pair that extends past
the allocated buffer.
When the callback reads the advertised payload, it triggers an out of
bounds read that can crash the client or expose adjacent process memory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H — 7.1 (HIGH)
Fixed in: libXtst 1.2.6
Fix: https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/b84737d84
Found by: Aisle Research (AISLE-Report-PSIRTSUPT-16762)
* CVE-2026-109088:
libXtst RECORD EnableContext Reply Endless Loop
parse_reply_call_callback() advances through RECORD EnableContext
reply elements by datum_bytes. A zero-sized XRecordFromClient
(BIG-REQUESTS length 0) or an undefined category byte leaves
datum_bytes at 0 while bytes remain, so the loop never terminates
and the application callback is invoked forever with empty data.
A malicious or compromised X server answering EnableContext can hang
XRecordEnableContext() (sync) or livelock Xlib reply processing
(async).
Fixed in: libXtst 1.2.6
Fix: https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/ac60f5f47
Found by: Kaya Emre Arikan.
========================================================================
X.Org thanks all of those who reported and fixed these issues, and those
who helped with the review and release of this advisory and these fixes.
The X.Org security team would like to take this opportunity to remind X
client authors that current best practices suggest separating code that
requires privileges from the GUI, to reduce the risk of issues like these.
--
-Alan Coopersmith- alan.coopersmith@...cle.com
X.Org Security Response Team - xorg-security@...ts.x.org
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (841 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
