Read the docs
TI-2026-81420 Aliases CVE-2026-109088GHSA-4rpx-8967-p725

Endless loop in libXtst RECORD EnableContext reply handling

Priority LOW 29CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-835.

Summary

libXtst from X.org before 1.2.6 is affected. The parse_reply_call_callback function mishandles malformed RECORD EnableContext replies, leaving a loop with no reachable exit (CWE-835). A malicious X server can send such replies to a client that connects to it, which then enters an endless loop.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A malicious X server could send malformed  RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00272 19th percentileScored 2026-11-07
Fix Partial libXtst (X.org): 1.2.6Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
x.orglibXtstbefore 1.2.61.2.6Patch availableCNA
  • libXtst Vendorx.org Affected before 1.2.6 Fixed in 1.2.6 Patch available CNA

Remediation

Update libXtst to 1.2.6, which fixes this flaw. Red Hat fixes it in RHSA-2026:93594 for Red Hat Hardened Images. Red Hat has no fix planned for Red Hat Enterprise Linux 6, and the sources list no fixed version for Red Hat Enterprise Linux 7, 8, 9 and 10.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA libXtst (X.org) Fixed in 1.2.6

Red Hat 1 advisory

  • RHSA-2026:93594 Released 2026-11-02 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images libXtst-1.2.5-5.3.hum1@aarch64, libXtst-1.2.5-5.3.hum1@s390x, libXtst-1.2.5-5.3.hum1@src +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:93594

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-109088
  2. 2026-10-27 Alias added: GHSA-4rpx-8967-p725
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-02 Affected versions changed · Red Hat
  5. 2026-11-02 CVSS score added · Red Hat
  6. 2026-11-03 Fix available: RHSA-2026:93594 · Red Hat
  7. 2026-11-03 Fix available: Red Hat Hardened Images · Red Hat
  8. 2026-11-04 CISA SSVC decision points changed

References

Patch 1

  • TI-2022-25238 In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for… CVSS 3.1HIGH 7.7
  • TI-1999-00519 An X server's access control is disabled (e.g. CVSS 2.0HIGH 10.0
  • TI-2021-11657 LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote… CVSS 3.1CRITICAL 9.8
  • TI-2018-10465 An issue was discovered in libX11 through 1.6.5. CVSS 3.0CRITICAL 9.8
  • TI-2004-00826 Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other… CVSS 2.0HIGH 10.0
  • TI-2016-08240 Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM… CVSS 3.0CRITICAL 9.8
See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences