CVE-2026-88806 is a buffer overflow vulnerability in libX11 prior to version 1.8.14. The flaw occurs during the processing of the XkbGetMap request, where the key_sym_map can be overflowed by a malicious X server. This could allow an attacker controlling an X server to cause memory corruption in the client using libX11, potentially leading to arbitrary code execution or denial of service. The vulnerability affects numerous specific libx11 package versions distributed in Ubuntu. The CVSS 3.1 score is 7.5 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a malicious X server to overflow a buffer in libX11 clients, potentially leading to arbitrary code execution or denial of service. The impact affects confidentiality, integrity, and availability of the affected systems. No known exploits in the wild have been reported at this time.

A fix is available in libX11 version 1.8.14 and later. Users and administrators should upgrade to libX11 1.8.14 or newer to remediate this vulnerability. Since this is a client-side library vulnerability triggered by a malicious X server, limiting exposure to untrusted X servers can reduce risk. Patch status is confirmed by the version cutoff at 1.8.14.