open-source-dependency-vulnerabilityendpoint-software-vulnerabilitywidely-deployed-product-advisory

X.Org Patches 17 Vulnerabilities Across Five X Client Libraries

Vulnerability Disclosure · 3 sources · Updated 11d ago · First seen Oct 16, 2026

X.Org disclosed 17 vulnerabilities across five X client libraries, releasing fixes for out-of-bounds reads and writes, heap buffer overflows, and denial-of-service conditions. Many flaws can be triggered by malicious or compromised X servers sending malformed replies or events to connected applications. Potential consequences include client crashes, exposure of adjacent process memory, heap corruption, excessive resource consumption, and application hangs. CVE-2026-94286 has the highest explicitly listed CVSS score at 7.1.

Fixed releases are libX11 1.8.14, libXi 1.8.4, libXpm 3.5.20, libXrender 0.9.13, and libXtst 1.2.6; administrators should deploy these versions or corresponding distribution security updates. X.Org also added hardening in libX11 and libXi and recommended separating privileged code from graphical interfaces. The disclosures follow a separate batch of 12 vulnerabilities in X.Org Server and XWayland published less than two weeks earlier, underscoring the need to review both client-library and server-side patch coverage.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Oct 16, 2026

Reported Oct 16, 202613d ago
A dozen vulnerabilities disclosed in X.Org Server and XWayland
Twelve vulnerabilities affecting X.Org Server and XWayland were published less than two weeks before the subsequent disclosure of X.Org client-library flaws.
17 More Security Vulnerabilities Made Public For X.Org Libraries - Phoronix
Oct 16, 202613d ago
X.Org releases fixes for all five affected client libraries
X.Org released libX11 1.8.14, libXi 1.8.4, libXpm 3.5.20, libXrender 0.9.13, and libXtst 1.2.6 to address the vulnerabilities. The libX11 and libXi releases also include additional hardening without assigned CVEs, which maintainers were advised to consider when cherry-picking fixes.
17 More Security Vulnerabilities Made Public For X.Org Libraries - Phoronix
Oct 16, 202613d ago
X.Org discloses 17 vulnerabilities across five client libraries
On October 16, 2026, X.Org disclosed 17 vulnerabilities affecting libX11, libXi, libXpm, libXrender, and libXtst, including out-of-bounds reads and writes, heap buffer overflows, and denial-of-service flaws. Many can be triggered by malformed replies or events from malicious X servers, potentially causing crashes, memory exposure, heap corruption, or application hangs.
17 More Security Vulnerabilities Made Public For X.Org Libraries - Phoronix

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

17 linked

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Oss Security Mailing ListNews · Oct 16, 2026

oss-sec: Fwd: X.Org Security Advisory: multiple security issues in X.Org X client librariesOpen source ↗

PhoronixNews · Oct 16, 2026

17 More Security Vulnerabilities Made Public For X.Org Libraries - PhoronixOpen source ↗

UnclassifiedNews · Oct 16, 2026

X.Org Security Advisory: multiple security issues in X.Org X client librariesOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

X.Org Patches 17 Vulnerabilities Across Five X Client Libraries

How this story unfolded

A dozen vulnerabilities disclosed in X.Org Server and XWayland

X.Org releases fixes for all five affected client libraries

X.Org discloses 17 vulnerabilities across five client libraries

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

X.Org Server and Xwayland Patch 12 Flaws, Including Nine Code-Execution Vulnerabilities

X.Org and Xwayland patch nine memory-safety flaws with root-level impact

X.Org fixes five memory-corruption flaws in X server, Xwayland, and libXfont2

X.Org Patches 17 Vulnerabilities Across Five X Client Libraries

How this story unfolded

A dozen vulnerabilities disclosed in X.Org Server and XWayland

X.Org releases fixes for all five affected client libraries

X.Org discloses 17 vulnerabilities across five client libraries

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

X.Org Server and Xwayland Patch 12 Flaws, Including Nine Code-Execution Vulnerabilities

X.Org and Xwayland patch nine memory-safety flaws with root-level impact

X.Org fixes five memory-corruption flaws in X server, Xwayland, and libXfont2