CVE-2026-94286 - Vulnerability Details - OpenCVE

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
X.org	Libxtst

No data.

No data.

References

Link	Providers
https://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/10/diffs?commit_id=16023c86070e6af9407330deea3938fcef75815b
https://nvd.nist.gov/vuln/detail/CVE-2026-94286
https://www.cve.org/CVERecord?id=CVE-2026-94286

History

Wed, 30 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 28 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-94286 https://www.cve.org/CVERecord?id=CVE-2026-94286
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 28 Sep 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
Title		Out-of-bounds read in libXtst's RECORD reply parser
First Time appeared		X.org X.org libxtst
Weaknesses		CWE-126
CPEs		cpe:2.3:a:x.org:libxtst::::::::
Vendors & Products		X.org X.org libxtst
References		https://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/10/diffs?commit_id=16023c86070e6af9407330deea3938fcef75815b
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: suse

Published: 2026-09-28T08:50:35.900Z

Updated: 2026-09-30T13:02:00.302Z

Reserved: 2026-09-21T09:33:25.369Z

Link: CVE-2026-94286

Vulnrichment

Updated: 2026-09-30T13:00:45.405Z

NVD

Status : Awaiting Analysis

Published: 2026-09-28T09:17:08.463

Modified: 2026-09-30T13:17:26.710

Link: CVE-2026-94286

Redhat

Severity : Important

Publid Date: 2026-09-28T08:50:35Z

Links: CVE-2026-94286 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94286", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-09-21T09:33:25.369Z", "datePublished": "2026-09-28T08:50:35.900Z", "dateUpdated": "2026-09-30T13:02:00.302Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-09-28T08:50:35.900Z"}, "title": "Out-of-bounds read in libXtst's RECORD reply parser", "datePublic": "2026-09-28T08:48:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-126", "description": "CWE-126 Buffer over-read", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "affected": [{"vendor": "x.org", "product": "libXtst", "packageName": "libXtst", "repo": "https://gitlab.freedesktop.org/xorg/lib/libxtst", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.6", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:x.org:libxtst:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "1.2.6"}]}]}], "descriptions": [{"lang": "en", "value": "An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.</p><br>"}]}], "references": [{"url": "https://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/10/diffs?commit_id=16023c86070e6af9407330deea3938fcef75815b", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"}}], "credits": [{"lang": "en", "value": "AISLE in partnership with Red Hat", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-30T12:58:55.309961Z", "id": "CVE-2026-94286", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T13:02:00.302Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94286", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T12:58:55.309961Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T13:00:45.405Z"}}], "cna": {"title": "Out-of-bounds read in libXtst's RECORD reply parser", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "AISLE in partnership with Red Hat"}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://gitlab.freedesktop.org/xorg/lib/libxtst", "vendor": "x.org", "product": "libXtst", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.6", "versionType": "rpm"}], "packageName": "libXtst", "defaultStatus": "unaffected"}], "datePublic": "2026-09-28T08:48:00.000Z", "references": [{"url": "https://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/10/diffs?commit_id=16023c86070e6af9407330deea3938fcef75815b", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.", "supportingMedia": [{"type": "text/html", "value": "<p>An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-126", "description": "CWE-126 Buffer over-read"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:x.org:libxtst:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.2.6", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-09-28T08:50:35.900Z"}}}, "cveMetadata": {"cveId": "CVE-2026-94286", "state": "PUBLISHED", "dateUpdated": "2026-09-30T13:02:00.302Z", "dateReserved": "2026-09-21T09:33:25.369Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-09-28T08:50:35.900Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}