Loading vulnerability…
Heap-based buffer overflow in libX11 XkbGetMap reply handling
CVE-2026-88806 is a heap-based buffer overflow in libX11 before version 1.8.14. Insufficient validation of server-supplied keycode ranges during XkbGetMap reply processing in _XkbReadKeyActions allows a malicious X server to supply keycodes exceeding max_keycode + 1, causing writes beyond the allocated key_sym_map array. The resulting memory corruption can crash the connected X11 client and may permit arbitrary code execution in its process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can cause denial of service through client application crashes and may enable arbitrary code execution with the privileges of the affected client process. Successful code execution could compromise the confidentiality and integrity of data accessible to that process. The CVSS v3 assessment assigns high potential confidentiality, integrity, and availability impacts; practical exploitation has high attack complexity.
If you can’t patch tonight, do this now.
Until patched, avoid connecting applications using vulnerable libX11 to untrusted or attacker-controlled X servers. Restrict remote-display connections and X11 forwarding to trusted servers and networks. Separate privileged functionality from graphical interfaces to reduce the consequences of client compromise. These measures reduce exposure but do not replace the security update.
Patch, then assume compromise.
Upgrade to upstream libX11 1.8.14 or later, or install the applicable distribution-provided security update containing the backported fix. Fixed RHEL packages include 1.8.12-1.el9_8.1 for RHEL 9.8 and 1.8.10-1.el10_2.1 for RHEL 10.2. Evaluate the complete distribution package release rather than the upstream version alone because patched packages may retain older upstream version numbers. Update affected container images and redeploy them. On Ubuntu, apply the applicable libx11-6 security update and reboot as instructed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.