Threat database

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

CVE-2026-94286 is a high-severity vulnerability in x.org's libXtst library before version 1.2.6. It involves a buffer over-read in the RECORD reply parser that could be exploited by malicious X servers to crash connected X clients. The vulnerability does not allow data modification or privilege escalation but can cause denial of service by crashing clients.

CVE-2026-94285 is an out-of-bounds read vulnerability in the byte-oriented codeset parser of libX11 versions before 1.8.14. This flaw could allow a malicious X server to crash connected X clients. The vulnerability has a medium severity rating with a CVSS score of 5.1. No known exploits are reported in the wild. Affected versions include all libX11 releases from 0 up to but not including 1.8.14.

CVE-2026-94284 is an out-of-bounds read vulnerability in the XIM trigger-key registration parser of libX11 versions before 1.8.14. This flaw could allow a malicious X server to cause a crash in attached X clients. The vulnerability has a medium severity rating with a CVSS score of 5.5, primarily impacting availability. No known exploits are reported in the wild. The issue affects libX11 versions from 0 up to but not including 1.8.14.

CVE-2026-94283 is an out-of-bounds read vulnerability in the X Input Method (XIM) attribute parser of libX11 versions before 1.8.14. This flaw could allow a malicious X server to crash connected X clients, causing denial of service. The vulnerability does not impact confidentiality or integrity but affects availability by causing application crashes.

CVE-2026-94282 is an out-of-bounds read vulnerability in the libXi library of x.org, specifically affecting versions before 1.8.4. The flaw occurs in the XI2 enter/leave/focus cookie conversion code and could be exploited by a malicious X server to crash an attached X client. This vulnerability has a medium severity rating with a CVSS score of 5.6.

An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client.

An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a

CVE-2026-88807 is a heap-based buffer overflow vulnerability in the libXrender library used by X.org. The flaw exists in the RenderQueryPictFormats function in libXrender versions before 0.9.13. A malicious X server could exploit this vulnerability to inject code into connected X clients. The vulnerability has a high severity score of 8.9 (CVSS 4.0) and requires user interaction with a high attack complexity. No known exploits are reported in the wild. A fix is implied to exist in version 0.9.13 and later.

CVE-2026-88806 is a heap-based buffer overflow vulnerability in libX11 versions before 1.8.14. It occurs during the handling of the XkbGetMap request, where the key_sym_map can be overflowed by a malicious X server. This vulnerability has a high severity with a CVSS score of 7.5. It requires user interaction and has a high impact on confidentiality, integrity, and availability.

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.

A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows attackers authenticated as X client to execute code within the X server.

A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.

A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service.