X.Org X11 Libraries CVE-2026-109088

Exploitation requires the victim's X11 client to establish a connection to an attacker-controlled, compromised, or man-in-the-middled X server; the flaw triggers only when that server returns a maliciously crafted reply or event (e.g. inconsistent length, count, or class-metadata fields) that the client library parses without adequate bounds checking. Limiting factors that reduce real-world risk: the X server is normally a local, trusted component, so exploitation presupposes an abnormal trust relationship such as X forwarding to a hostile host or a rogue display server; the observed impact across the advisory family is primarily a client crash (denial of service) with at most limited memory disclosure, not confirmed code execution for this component.

No CVSS vector, EPSS score, KEV entry, POC, or SSVC decision point was provided for CVE-2026-109088 specifically, so quantitative exploitation signals are absent and risk must be inferred from the X.Org advisory class it belongs to. IMPORTANT DATA CONFLICT: the identifier CVE-2026-109088 does not appear anywhere in the provided advisory text, which enumerates CVE-2026-88806, 94283, 94284, 94285 (libX11) and 93541-93545 (libXi); the references and the two linked code diffs instead point to libXrender (XRenderQueryFormats bounds hardening in Xrender.c) and libXtst (XRecord.c parse_reply_call_callback, a follow-up to CVE-2016-7952) - verify the exact affected component and CVSS with the vendor. Across this entire advisory family the sibling CVEs score MEDIUM (5.3-6.5) and share one threat model: a malicious, compromised, or MITM'd X server sends crafted replies/events that trigger out-of-bounds reads/writes in the X CLIENT library, overwhelmingly producing a crash (A:H) rather than code execution. That model is the dominant risk-limiting factor: in typical deployments the X server is local and trusted, so remote unauthenticated mass exploitation is not realistic - the attacker must first control or interpose on the X protocol connection (e.g. SSH X-forwarding to a hostile host). Net assessment: real-world priority is LOW-to-MODERATE despite the ubiquity of the affected libraries - patch via normal distro channels, but there is no evidence of active exploitation or weaponization. Sibling OOB-write CVE-2026-88806 is the one theoretically higher-impact member, but 109088's own impact cannot be confirmed from the supplied data.

An attacker controls or compromises an X server (for example a rogue display server, or a malicious host reached via SSH X11 forwarding) that a victim's X11 client connects to. The server returns a crafted protocol reply or event with inconsistent length/count fields, driving the client's X library to read or write past a buffer, crashing the client and potentially disclosing adjacent process memory. No public exploit identified at time of analysis.