Executive brief
libX11 is a core library that allows applications to communicate with X servers for graphical display on Unix-like systems. A malicious X server can trigger a buffer overflow by sending a specially crafted XkbGetMap response that exceeds keyboard mapping boundaries, potentially allowing code execution or system compromise on the client machine.
Technical details
A buffer overflow exists in libX11 before 1.8.14 in the _XkbReadKeyActions function where a malicious server can send a XkbGetMap reply with firstKeyAct + nKeyActs exceeding max_keycode + 1, causing out-of-bounds writes to the key_sym_map array. The vulnerability requires network access to a running X server and no user interaction beyond normal X client operation. The fix adds range validation to ensure keysym indices stay within bounds.
Affected products
- X.Org libX11 before 1.8.14
Timeline
- 2026-09-21: disclosed: CVE-2026-88806 published
- 2026-09-18: patched: Fix merged in libX11 via merge request 309