USN-8913-1: libx11 vulnerabilities

CVE-2026-88806 is a high-severity buffer overflow vulnerability in the libX11 library, specifically within the XkbGetMap function, which could lead to arbitrary code execution. The flaw is triggered when processing a malicious X server response that overflows the key_sym_map structure, requiring the client to connect to a compromised or attacker-controlled X server. A successful exploit would grant the attacker the same privileges as the connected user, potentially leading to complete system compromise. The vulnerability affects all versions of libX11 prior to 1.8.14. There are no known public proofs-of-concept or reports of exploitation in the wild at this time.

Do: Upgrade to libX11 version 1.8.14 or later, as this is the patched release. Check your system's package manager for the installed libX11 version and apply the vendor-provided security update. Since exploitation requires a malicious X server, ensure your X Window System environment is trusted and restrict connections to unknown or untrusted servers.

libX11, the core client-side library for the X Window System, contains an out-of-bounds read (CWE-125) in the XIM (X Input Method) attribute parser in versions before 1.8.14. A malicious or compromised X server can send crafted XIM attribute data that the client-side parser reads past the end of a buffer, crashing any attached X client that uses input-method support. The impact is denial of service against the client application (availability only — no confidentiality or integrity impact), and exploitation requires a user to connect to the attacker-controlled X server, which most plausibly happens via X11 forwarding (e.g., ssh -X/-Y) to an untrusted or compromised remote host. Because libX11 ships by default on virtually every X11-based Linux/Unix desktop, the install base is enormous, though the attack path limits practical targets. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and there is no indication of exploitation in the wild; fixes are shipping through distributions such as Ubuntu (USN-8913-1) and SUSE.

Do: Update libX11 to 1.8.14 or later via your distribution's packages (e.g., Ubuntu USN-8913-1, SUSE updates) and verify with 'dpkg -l libx11-6' or 'rpm -q libX11'. Restrict X11 forwarding: avoid 'ssh -X'/'ssh -Y' to untrusted hosts, keep X11Forwarding disabled where it is not needed, and prefer Wayland or native remote protocols when available. No restart-specific action beyond restarting long-running X clients after the library update is required.