Loading vulnerability…
Out-of-bounds read in libXtst RECORD reply parser
CVE-2026-94286 is an out-of-bounds read vulnerability in the RECORD reply parser of libXtst versions before 1.2.6. A malicious X server can supply a malformed RECORD reply with an excessive datum_bytes value, causing the parser to pass a callback a pointer and length extending beyond the allocated reply buffer. When the callback reads the advertised payload, it can crash the connected X client or expose adjacent process memory.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can terminate an affected X client, causing application-level denial of service. Reading beyond the reply buffer can also expose adjacent process memory, creating a potential confidentiality impact. No integrity impact or remote code execution is established.
If you can’t patch tonight, do this now.
Until patched, avoid connecting affected X clients to untrusted or potentially compromised X servers and restrict unnecessary remote X connections. Separate privileged code from graphical interfaces to reduce the consequences of X client library vulnerabilities. These precautions do not replace the security update.
Patch, then assume compromise.
Upgrade to libXtst 1.2.6 or later, or install the operating-system vendor's backported security update. Update all installed affected runtime, development, and 32-bit packages, including copies in containers and cloud images. Distribution packages may retain an earlier upstream version while incorporating the fix; verify the fixed package release against the applicable vendor advisory.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.