CVE-2026-88806 libX11 XkbGetMap Reply Heap-based Buffer Overflow
A malicious X server can trigger a heap-based buffer overflow in libX11, potentially allowing arbitrary code execution on the client system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-88806?
CVE-2026-88806 is a high-severity memory corruption vulnerability in x.org libX11, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.
Weakness: CWE-122
Which versions are affected by CVE-2026-88806?
Linux distribution packages (18)
libX11 AlmaLinux:10 | All versions | 1.8.10-1.el10_2.1 |
libX11-common AlmaLinux:10 | All versions | 1.8.10-1.el10_2.1 |
libX11-devel AlmaLinux:10 | All versions | 1.8.10-1.el10_2.1 |
libX11-xcb AlmaLinux:10 | All versions | 1.8.10-1.el10_2.1 |
libX11 AlmaLinux:8 | All versions | 1.6.8-10.el8_10 |
libX11-common AlmaLinux:8 | All versions | 1.6.8-10.el8_10 |
libX11-devel AlmaLinux:8 | All versions | 1.6.8-10.el8_10 |
libX11-xcb AlmaLinux:8 | All versions | 1.6.8-10.el8_10 |
libX11 AlmaLinux:9 | All versions | 1.8.12-1.el9_8.1 |
libX11-common AlmaLinux:9 | All versions | 1.8.12-1.el9_8.1 |
libX11-devel AlmaLinux:9 | All versions | 1.8.12-1.el9_8.1 |
libX11-xcb AlmaLinux:9 | All versions | 1.8.12-1.el9_8.1 |
libX11 Rocky Linux:8 | All versions | 0:1.6.8-10.el8_10 |
libX11 SUSE:Linux Enterprise Server 16.0 | All versions | 1.8.10-160000.4.1 |
libX11 SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 1.8.10-160000.4.1 |
libX11 SUSE:Linux Micro 6.2 | All versions | 1.8.10-160000.4.1 |
libX11 openSUSE:Leap 16.0 | All versions | 1.8.10-160000.4.1 |
libX11 openSUSE:Tumbleweed | All versions | 1.8.13-2.1 |
How do I fix CVE-2026-88806?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-88806 being exploited?
There is no known exploitation of CVE-2026-88806 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-88806, ALSA-2026:89730, ALSA-2026:91365, ALSA-2026:91366, AZL-103388, BELL-CVE-2026-88806 and 13 more.