# CVE-2026-88806: libX11 buffer overflow in XkbGetMap key_sym_map handling

Source: https://junglewise.ai/threats/cve-2026-88806-a-malicious-x-server-could-exploit-a-buffer-overflow-in-libx11  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88806 · Severity: high · CVSS 7.5 · Published 2026-09-21

libX11 is a core library that allows applications to communicate with X servers for graphical display on Unix-like systems. A malicious X server can trigger a buffer overflow by sending a specially crafted XkbGetMap response that exceeds keyboard mapping boundaries, potentially allowing code execution or system compromise on the client machine.

Technologies: [X.Org libX11](https://junglewise.ai/threats/technologies/libx11). Vendors: [X.Org](https://junglewise.ai/threats/vendors/x-org).

## Quick answers

**Is CVE-2026-88806 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88806 being exploited in the wild.

**How severe is CVE-2026-88806?** High severity, with a CVSS score of 7.5, published 21 September 2026.

**Which products and versions are affected?** X.Org libX11 before 1.8.14.

**Is there a fix for CVE-2026-88806?** A patch was published on 2026-09-18: Fix merged in libX11 via merge request 309 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88806 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88806?** Check whether you run X.Org libX11 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow exists in libX11 before 1.8.14 in the _XkbReadKeyActions function where a malicious server can send a XkbGetMap reply with firstKeyAct + nKeyActs exceeding max_keycode + 1, causing out-of-bounds writes to the key_sym_map array. The vulnerability requires network access to a running X server and no user interaction beyond normal X client operation. The fix adds range validation to ensure keysym indices stay within bounds.

## Affected products

- X.Org libX11 before 1.8.14

## Timeline

- 2026-09-21: disclosed: CVE-2026-88806 published
- 2026-09-18: patched: Fix merged in libX11 via merge request 309

## References

- [https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309](https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309)

## Related threats

- [libX11 out-of-bounds read in XIM trigger-key registration parser](https://junglewise.ai/threats/cve-2026-94284-an-out-of-bounds-read-vulnerability-in-libx11-s-xim-trigger-key)
- [libX11 out-of-bounds read in XIM attribute parser](https://junglewise.ai/threats/cve-2026-94283-an-out-of-bounds-read-vulnerability-in-libx11-s-xim-x-input)