An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X… (CVE-2026-94285)
Description
An out-of-bounds read vulnerability exists in libX11's byte-oriented codeset parser in versions before 1.8.14. This flaw could be exploited by a malicious X server to crash attached X clients, resulting in a denial of service. The vulnerability has a medium severity rating and a CVSS score of 5.1. A patch addressing this issue is available and should be applied to affected systems.
CVSS v3.1
Score 5.1medium
Affected software
pkg:deb/ubuntu/libx11?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/libx11?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/libx11?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/libx11?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/libx11?arch=source&distro=jammypkg:deb/ubuntu/libx11?arch=source&distro=noblepkg:deb/ubuntu/libx11?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-94285 describes an out-of-bounds read in libX11's byte-oriented codeset parser affecting libX11 versions prior to 1.8.14. This vulnerability allows a malicious X server to cause a crash of connected X clients by exploiting improper handling of multibyte text conversion. The issue can lead to denial of service and potentially arbitrary code execution. Multiple Ubuntu package versions are affected, and fixes have been released in updated libx11 packages across various Ubuntu LTS releases.
Potential Impact
If exploited, this vulnerability can cause libX11 clients to crash, resulting in denial of service. There is also a possibility of arbitrary code execution, although the primary confirmed impact is a crash. The attack requires a user to connect to a malicious X server, which could be remote or local depending on the environment.
Mitigation Recommendations
A fix is available and has been released by Ubuntu in updated libx11 package versions for all supported LTS releases. Users should apply these updates promptly and reboot their systems to ensure the patch is active. The vendor advisory (Ubuntu Security Notice USN-8913-1) provides detailed package versions for remediation. No additional mitigation steps are indicated beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-94285
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Patch Information
Threat ID: 6acd555a2cdf04f656da85dd
Added to database: 10/12/2026, 21:47:06 UTC
Last enriched: 10/12/2026, 22:00:32 UTC
Last updated: 10/12/2026, 22:00:32 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.