CVE-2026-109088

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109088", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-10-12T06:41:23.778Z", "datePublished": "2026-10-27T16:26:20.597Z", "dateUpdated": "2026-11-04T17:46:18.017Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-27T16:26:20.597Z"}, "title": "libXtst RECORD EnableContext Reply Endless Loop", "datePublic": "2026-10-27T16:10:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-835", "description": "CWE-835 Loop with unreachable exit condition ('infinite loop')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-227", "descriptions": [{"lang": "en", "value": "CAPEC-227 Sustained Client Engagement"}]}], "affected": [{"vendor": "X.org", "product": "libXtst", "packageName": "libXtst", "repo": "https://gitlab.freedesktop.org/xorg/lib/libxtst", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.6", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:x.org:libxtst:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "1.2.6"}]}]}], "descriptions": [{"lang": "en", "value": "A malicious X server could send malformed\u00a0\u00a0RECORD EnableContext\u00a0reolies that can cause a X client using the\u00a0parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A malicious X server could send malformed&nbsp;&nbsp;<span>RECORD EnableContext</span>&nbsp;reolies that can cause a X client using the&nbsp;<span>parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.&nbsp;</span>"}]}], "references": [{"url": "https://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/11", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}}], "credits": [{"lang": "en", "value": "Kaya Emre Arikan", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T17:45:58.312856Z", "id": "CVE-2026-109088", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T17:46:18.017Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-109088", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T17:45:58.312856Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T17:46:12.402Z"}}], "cna": {"title": "libXtst RECORD EnableContext Reply Endless Loop", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Kaya Emre Arikan"}], "impacts": [{"capecId": "CAPEC-227", "descriptions": [{"lang": "en", "value": "CAPEC-227 Sustained Client Engagement"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://gitlab.freedesktop.org/xorg/lib/libxtst", "vendor": "X.org", "product": "libXtst", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.6", "versionType": "rpm"}], "packageName": "libXtst", "defaultStatus": "unaffected"}], "datePublic": "2026-10-27T16:10:00.000Z", "references": [{"url": "https://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/11", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A malicious X server could send malformed\u00a0\u00a0RECORD EnableContext\u00a0reolies that can cause a X client using the\u00a0parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.", "supportingMedia": [{"type": "text/html", "value": "A malicious X server could send malformed&nbsp;&nbsp;<span>RECORD EnableContext</span>&nbsp;reolies that can cause a X client using the&nbsp;<span>parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.&nbsp;</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835 Loop with unreachable exit condition ('infinite loop')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:x.org:libxtst:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.2.6", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-27T16:26:20.597Z"}}}, "cveMetadata": {"cveId": "CVE-2026-109088", "state": "PUBLISHED", "dateUpdated": "2026-11-04T17:46:18.017Z", "dateReserved": "2026-10-12T06:41:23.778Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-10-27T16:26:20.597Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "libXtst", "product": "libXtst", "repo": "https://gitlab.freedesktop.org/xorg/lib/libxtst", "vendor": "X.org", "versions": [{"lessThan": "1.2.6", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "meissner@suse.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A malicious X server could send malformed\u00a0\u00a0RECORD EnableContext\u00a0reolies that can cause a X client using the\u00a0parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop."}], "id": "CVE-2026-109088", "lastModified": "2026-11-04T18:17:36.600", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "meissner@suse.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-109088", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T17:45:58.312856Z", "version": "2.0.3"}}]}, "published": "2026-10-27T17:16:57.680", "references": [{"source": "meissner@suse.de", "url": "https://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/11"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{"bugzilla": {"description": "libXtst: libXtst: Denial of Service via malformed RECORD EnableContext replies", "id": "2562156", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562156"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["A malicious X server could send malformed\u00a0\u00a0RECORD EnableContext\u00a0reolies that can cause a X client using the\u00a0parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.", "A flaw was found in libXtst. A malicious X server can send malformed RECORD EnableContext replies to a connected client. When processing these malformed responses, the client enters an infinite loop, resulting in a Denial of Service (DoS) condition where the application becomes unresponsive."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-109088", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libXtst", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libXtst", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "libXtst", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libXtst", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libXtst", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libXtst", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-27T16:26:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-109088\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109088\nhttps://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/11"], "statement": "This vulnerability is rated Moderate because triggering the condition requires an X11 client application to connect to an untrusted or compromised X server, limiting the blast radius to a localized application hang. In typical Red Hat Enterprise Linux environments, client applications communicate exclusively with trusted local display servers, substantially mitigating exposure under default configurations. Furthermore, successful exploitation results only in the client process looping indefinitely, without compromising data confidentiality or system integrity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.2.6)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "libXtst", "source": "cna", "vendor": "X.org"}, "product": "libxtst", "vendor": "x.org"}], "created": "2026-10-27T17:30:07.277394+00:00", "updated": "2026-10-27T17:45:06.455359+00:00", "vendors": ["x.org", "x.org$PRODUCT$libxtst"]}