CVE-2026-94285: libX11 Out-of-Bounds Read DOS Vulnerability

CVE-2026-94285 Overview

CVE-2026-94285 is an out-of-bounds read vulnerability in libX11, the core client library for the X Window System. The flaw resides in the byte-oriented codeset parser used when processing locale and codeset data from an X server. A malicious X server can trigger the condition in an attached X client, causing the client process to crash. The issue affects libX11 versions before 1.8.14 and is tracked under CWE-125: Out-of-bounds Read. The vulnerability requires local access with no privileges or user interaction and impacts confidentiality and availability at a limited scope.

Critical Impact
A malicious or compromised X server can crash connected X clients and may read memory outside intended buffers during codeset parsing.

Affected Products

X.Org libX11 versions prior to 1.8.14
Linux and Unix-like distributions bundling vulnerable libX11 builds
Applications linking against the affected libX11 byte-oriented codeset parser

Discovery Timeline

2026-09-28 - CVE-2026-94285 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-94285

Vulnerability Analysis

The vulnerability lives in the byte-oriented codeset parsing path inside libX11. When an X client receives codeset-related data from an X server, the parser reads bytes without correctly validating buffer boundaries. The parser advances past the end of the intended input buffer, producing an out-of-bounds read. The result is undefined behavior that typically terminates the client process with a segmentation fault. Because libX11 sits beneath nearly every X11 graphical application, any program that connects to an attacker-controlled X server inherits the exposure.

Root Cause

The root cause is missing or incorrect bounds checking in the byte-oriented codeset parser. The parser trusts length or terminator conditions in the input stream rather than enforcing hard limits against the allocated buffer. Classified as CWE-125, the defect allows the read pointer to advance beyond the mapped region.

Attack Vector

Exploitation requires an attacker to control an X server to which a victim client connects. This scenario arises when a user sets DISPLAY to a hostile endpoint, forwards X11 over SSH to an untrusted host, or runs clients inside containers configured to use an attacker-reachable display. The server returns crafted codeset data that drives the parser past the buffer boundary. The result is a denial of service against the client and potential disclosure of adjacent process memory contents through subsequent processing.

For technical details, review the upstream fix in the GitLab Merge Request Diff.

Detection Methods for CVE-2026-94285

Indicators of Compromise

Repeated crashes of X11 client applications shortly after connecting to a non-local DISPLAY endpoint
Core dumps from processes linked against libX11 with stack frames inside codeset or locale parsing routines
X11 forwarding sessions where remote hosts repeatedly cause GUI clients to terminate unexpectedly

Detection Strategies

Inventory installed libX11 package versions across Linux hosts and flag any build earlier than 1.8.14
Monitor process termination events for X11 clients that exit abnormally with SIGSEGV immediately after display connection
Audit DISPLAY environment variable values and SSH ForwardX11 configurations for connections to untrusted hosts

Monitoring Recommendations

Collect kernel audit and systemd-coredump records for repeated faults in libX11 call stacks
Alert on new or unexpected outbound TCP connections to port 6000-6063 (X11) from desktop or workstation hosts
Track package manager events that install or downgrade libX11 to versions below 1.8.14

How to Mitigate CVE-2026-94285

Immediate Actions Required

Upgrade libX11 to version 1.8.14 or later using your distribution's package manager once the fixed build is published
Disable X11 forwarding to untrusted remote hosts by setting ForwardX11 no in ssh_config
Avoid pointing DISPLAY at X servers controlled by other users or untrusted systems

Patch Information

The upstream fix is published in the X.Org libX11 repository and ships in release 1.8.14. Review the corrective changes in the GitLab Merge Request Diff. Rebuild downstream applications that statically link against libX11 after the library update.

Workarounds

Restrict X11 clients to local Unix domain socket displays and refuse TCP display connections where feasible
Use Wayland sessions on hosts where libX11 cannot be updated promptly, reducing reliance on the vulnerable parser
Run X11 clients inside sandboxes such as bubblewrap or firejail to contain the impact of a crash or memory disclosure

bash

# Disable X11 TCP listener and forwarding
# /etc/ssh/ssh_config
Host *
    ForwardX11 no
    ForwardX11Trusted no

# Start X server without TCP listening (nolisten tcp)
startx -- -nolisten tcp