← All advisories

High severity7.1NVD Advisory· Published Sep 28, 2026· Updated Sep 30, 2026

CVE-2026-94286

CVE-2026-94286

Description

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5

LibXtst/libXtstllm-fuzzy
Range: <1.2.6
osv-coords4 versions
pkg:rpm/opensuse/libXtst&distro=openSUSE%20Leap%2016.0 pkg:rpm/almalinux/libXtst-devel pkg:rpm/opensuse/libXtst&distro=openSUSE%20Tumbleweed pkg:rpm/almalinux/libXtst
< 1.2.5-160000.4.1+ 3 more
- (no CPE)range: < 1.2.5-160000.4.1
- (no CPE)range: < 1.2.3-16.el9_8.1
- (no CPE)range: < 1.2.5-2.1
- (no CPE)range: < 1.2.3-16.el9_8.1

Patches

Vulnerability mechanics

References

1

gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/10/diffsnvd

News mentions

1

Xorg Libraries: Six Vulnerabilities Including DoS and Client Crashes Disclosed Together
Vypr Intelligence · Sep 28, 2026