An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to… (CVE-2026-94284)

CVE-2026-94284 is an out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser affecting libX11 versions prior to 1.8.14. A malicious X server could exploit this flaw to cause libX11 to crash attached X clients, resulting in denial of service. The issue is one of several libX11 vulnerabilities fixed in Ubuntu security notices, with patches released for various Ubuntu LTS versions. The vulnerability does not provide evidence of code execution but can cause application crashes.

Successful exploitation allows a malicious X server to crash X clients using libX11, resulting in denial of service. There is no confirmed impact on confidentiality or integrity, and no known exploits in the wild. The CVSS vector indicates local attack vector with low complexity, no privileges required, user interaction required, and impact limited to availability.

A patch is available and should be applied by updating libx11 to the fixed versions as per the Ubuntu security advisory USN-8913-1. After updating, a system reboot is recommended to ensure all changes take effect. Users of affected Ubuntu releases should install the updated libx11 packages listed in the advisory. No additional mitigation is required beyond applying the official fix.