Read the docs
TI-2026-60214 Aliases CVE-2026-88806GHSA-xrgw-w7v2-3qp8

libX11 XkbGetMap Reply Heap-based Buffer Overflow

Priority LOW 34CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 8 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00202 10th percentileScored 2026-11-07
Fix Partial libX11 (x.org): 1.8.14Red Hat: 8 advisoriesRed Hat: 8 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
x.orglibX11before 1.8.141.8.14Patch availableCNA
  • libX11 Vendorx.org Affected before 1.8.14 Fixed in 1.8.14 Patch available CNA

Remediation

  • Fix · CNA libX11 (x.org) Fixed in 1.8.14

Red Hat 8 advisories

  • RHSA-2026:95499 Released 2026-11-05 · Red Hat rating Important
    libX11 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libX11-1.8.10-1.el10_0.1, libX11-common-1.8.10-1.el10_0.1, libX11-devel-1.8.10-1.el10_0.1 +1
  • RHSA-2026:95498 Released 2026-11-05 · Red Hat rating Important
    libX11 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libX11-1.7.0-11.el9_6.1, libX11-common-1.7.0-11.el9_6.1, libX11-devel-1.7.0-11.el9_6.1 +1
  • RHSA-2026:95497 Released 2026-11-05 · Red Hat rating Important
    libX11 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) libX11-1.7.0-9.el9_4.1, libX11-common-1.7.0-9.el9_4.1, libX11-devel-1.7.0-9.el9_4.1 +1
Show 5 more Red Hat advisories
  • RHSA-2026:95496 Released 2026-11-05 · Red Hat rating Important
    libX11 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libX11-1.7.0-8.el9_2.1, libX11-common-1.7.0-8.el9_2.1, libX11-devel-1.7.0-8.el9_2.1 +1
  • RHSA-2026:94802 Released 2026-11-04 · Red Hat rating Critical
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:91365 Released 2026-10-29 · Red Hat rating Important
    libX11 security update
    • Red Hat Enterprise Linux AppStream (v. 9) libX11-1.8.12-1.el9_8.1, libX11-common-1.8.12-1.el9_8.1, libX11-devel-1.8.12-1.el9_8.1 +1
  • RHSA-2026:91366 Released 2026-10-27 · Red Hat rating Important
    libX11 security update
    • Red Hat Enterprise Linux AppStream (v. 10) libX11-1.8.10-1.el10_2.1, libX11-common-1.8.10-1.el10_2.1, libX11-devel-1.8.10-1.el10_2.1 +1
  • RHSA-2026:89730 Released 2026-10-26 · Red Hat rating Important
    libX11 security update
    • Red Hat Enterprise Linux AppStream (v. 8) libX11-1.6.8-10.el8_10, libX11-common-1.6.8-10.el8_10, libX11-devel-1.6.8-10.el8_10 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Discovery 2Fixed RHSA-2026:94802
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:91366
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:89730
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:91365
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:95496
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:95497
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:95499
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:95498
Not affected: 2 products
  • Red Hat Discovery 2
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-88806
  2. 2026-10-03 Alias added: GHSA-xrgw-w7v2-3qp8
  3. 2026-10-26 Fix available: RHSA-2026:89730 · Red Hat
  4. 2026-10-26 Fix available: Red Hat Enterprise Linux AppStream (v. 8) · Red Hat
  5. 2026-10-30 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
  6. 2026-10-30 Fix available: RHSA-2026:91365 · Red Hat
  7. 2026-10-30 Fix available: RHSA-2026:91366 · Red Hat
  8. 2026-11-04 Fix available: RHSA-2026:94802 · Red Hat
  9. 2026-11-04 Fix available: Red Hat Discovery 2 · Red Hat
  10. 2026-11-05 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux AppStream EUS (v. 10.0) +1 · Red Hat
  11. 2026-11-06 Fix available: RHSA-2026:95496 · Red Hat
  12. 2026-11-06 Fix available: RHSA-2026:95498 · Red Hat
  13. 2026-11-06 Fix available: RHSA-2026:95497 · Red Hat
  14. 2026-11-06 Fix available: RHSA-2026:95499 · Red Hat

References

Patch 1

  • TI-2022-25238 In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for… CVSS 3.1HIGH 7.7
  • TI-1999-00519 An X server's access control is disabled (e.g. CVSS 2.0HIGH 10.0
  • TI-2021-11657 LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote… CVSS 3.1CRITICAL 9.8
  • TI-2018-10465 An issue was discovered in libX11 through 1.6.5. CVSS 3.0CRITICAL 9.8
  • TI-2004-00826 Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other… CVSS 2.0HIGH 10.0
  • TI-2016-08240 Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM… CVSS 3.0CRITICAL 9.8
See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences