CVE-2026-94285
MediumCVSS 5.1Summary
An out-of-bounds read in libX11's byte-oriented codeset parser before 1.8.14 could be used by malicious X servers to crash attached X clients.
Risk Assessment
A malicious X server may crash X clients, leading to disruption of user sessions or data loss.
Recommendation
Update libX11 to version 1.8.14 or later to fix the vulnerability.
Other vulnerabilities in libX11
See all- CVE-2026-94284Medium
An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser before 1.8.14 could be used by malicious X servers to crash attached X clients.
- CVE-2026-94283Medium
An out-of-bounds read vulnerability in libX11's XIM attribute parser before 1.8.14 could be used by malicious X servers to crash attached X clients.
- CVE-2026-88806High
A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.
- CVE-2023-3138High
A vulnerability was found in libX11 due to a lack of checks on values passed to functions in src/InitExt.c. These values are used as array indexes, which can lead to overwriting other parts of the Display structure, potentially causing the client to crash due to memory corruption.
Original NVD description (English source)
An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS