CVE-2026-109088

What it actually does

Malformed RECORD EnableContext replies from a malicious X server trigger an infinite loop inside parse_reply_call_callback in libXtst < 1.2.6, causing the client process to stop responding.

Why it matters to the business

X11 client applications become unresponsive, disrupting user sessions and requiring process restarts or system reboots; the flaw is four days old with stable low exploitability scores and no known in-the-wild use.

How an attack unfolds

An attacker positions a malicious X server on the network; when a vulnerable libXtst client connects and requests RECORD extension context, the server replies with crafted EnableContext data that the parse_reply_call_callback function cannot handle, entering an endless loop and denying service to the client.

How to fix it

Upgrade libXtst to version 1.2.6 or newer on all affected systems; rebuild or reinstall any packages that statically link against the vulnerable library.

How to confirm the fix worked

Verify installed libXtst version is 1.2.6 or later; run a simple X client that exercises RECORD extension against a test server sending crafted replies and confirm the client does not hang.

Typical attack path

1. Position or compromise an X server reachable by target clients
2. Wait for or induce a vulnerable X client to connect and enable the RECORD extension
3. Transmit a malformed EnableContext reply that reaches parse_reply_call_callback
4. Observe the client process enter an infinite loop and stop responding

How to detect it

Look for X11 client processes consuming sustained high CPU without user interaction; correlate with connection attempts to untrusted X servers in system and audit logs.

What your security team should do

• Patch libXtst to 1.2.6 within the next maintenance window
• Inventory all systems and containers that ship or link libXtst
• Monitor CPU and process responsiveness for X11 clients until patches are deployed