X.Org X Libraries CVE-2026-109089

Exploitation requires the victim X client to connect to and parse replies from a malicious or compromised X server (for libXtst/XRecord and libXrender parsing paths) - the attacker must control the server side of the X protocol connection, e.g. via X11 forwarding (ssh -X / -Y) to a hostile host or a compromised display server. This inverts the normal trust assumption that the X server is trusted, which is the primary limiting factor. Per the advisory's sibling CVEs the impact is confined to out-of-bounds reads causing client crashes (availability only); user interaction is effectively required (the user must launch/connect the affected client), and there is no indication of code execution or data disclosure for this read-class issue. Affected only prior to libXrender 0.9.13 / libXtst 1.2.6 (and the other listed library versions).

This entry (CVE-2026-109089) is part of the October 16, 2026 X.Org Security Advisory covering a batch of client-library parsing flaws in libX11, libXi, libXpm, libXrender, and libXtst. No CVSS vector, EPSS score, KEV listing, or POC is provided for this specific CVE ID in the input, so quantitative exploitation signals are MISSING and cannot be compared. The references and linked diffs tie this ID to libXrender (XRenderQueryFormats bounds-checking of numSubpixel/length in Xrender.c) and/or libXtst (XRecord parse_reply_call_callback loop-livelock/OOB hardening in XRecord.c), but the advisory text itself does not enumerate a CVE-2026-109089 line, so the exact sub-issue mapping is INFERRED from the reference commits, not confirmed. Across the entire advisory the pattern is consistent: a malicious or compromised X server (or XIM server) sends crafted replies/events that drive client-side parsers past buffer bounds, yielding out-of-bounds reads and client crashes (the sibling CVEs with vectors all score MEDIUM 5.3-6.5 with C/I mostly None and A:H). The dominant real-world limiter is the inverted trust model: these libraries normally parse data from a trusted local X server, so exploitation presupposes the client connecting to an attacker-controlled or compromised server (e.g., X11 forwarding to a hostile host). Net assessment: a real hardening priority for distributions to ship, but low practical urgency as a denial-of-service class issue absent any evidence of active exploitation or confidentiality/integrity impact in this CVE.

A user runs an X11 client that connects to a malicious or compromised X server - for example via SSH X11 forwarding (ssh -X) to an untrusted remote host. The hostile server returns a crafted reply (e.g., a QueryFormats/RenderQueryFormats reply or an XRecord reply with inconsistent length fields), and the client library parses it without adequate bounds checks, reading past its buffer and crashing the client. No public exploit is identified in the provided data.