Summary
Adam Bedard discovered that libx11 incorrectly handled certain XKB keyboard
map replies. If a user were tricked into connecting to a malicious X
server, a remote attacker could possibly use this issue to cause libx11 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2026-88806)
It was discovered that libx11 incorrectly handled certain X Input Method
(XIM) messages. If a user were tricked into connecting to a malicious X
server, a remote attacker could possibly use these issues to cause libx11
to crash, resulting in a denial of service. (CVE-2026-94283,
CVE-2026-94284)
It was discovered that libx11 incorrectly handled converting certain
multibyte text. An attacker could possibly use this issue to cause libx11
to crash, resulting in a denial of service. (CVE-2026-94285)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libx11 | 2:1.7.5-1ubuntu0.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | libx11 | 2:1.8.7-1ubuntu0.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | libx11 | 2:1.8.13-1ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libx11 | 2:1.6.2-1ubuntu2.1+esm6 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libx11 | 2:1.6.3-1ubuntu2.2+esm5 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libx11 | 2:1.6.4-3ubuntu0.4+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libx11 | 2:1.6.9-2ubuntu1.6+esm1 |
Vulnerabilities 4
-
High 7.5
libX11 XkbGetMap Reply Heap-based Buffer Overflow
A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.
-
Medium 6.5
Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser
An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.
-
Medium 5.5
Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser
An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.
-
Medium 5.1
Out-of-bounds read in libX11's byte-oriented codeset parser
An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.