CVE-2026-94286

libXtst before 1.2.6 has an out-of-bounds read (CWE-126) in its RECORD extension reply parser. A malicious X server can trigger the flaw when an attached X client parses a crafted RECORD reply, crashing that client and potentially exposing a limited amount of memory. The issue is rated CVSS 3.1 7.1 (high): network-reachable, low complexity, no privileges required, and user interaction required, with low confidentiality impact and high availability impact. Systems that ship the vulnerable library—primarily Linux and other Unix hosts using X11 client libraries—are affected until updated to 1.2.6 or later. No public proof-of-concept is known, and the flaw is not listed in CISA KEV.

What to do: Update libXtst to version 1.2.6 or later through your distribution's security updates. Until the package is patched, do not connect X clients to untrusted or remote X servers. After updating, confirm the installed libXtst (often packaged as libxtst) is 1.2.6 or newer.