X.Org X Libraries CVE-2026-109090

Exploitation requires the victim's X client application (linked against the affected libXrender/libXtst/libX11 code) to connect to and receive replies from a malicious or compromised X server - this inverts the normal X11 trust model, in which the client trusts its server. The crafted reply carries inconsistent length/count fields (e.g. mismatched numSubpixel/numScreens in XRenderQueryFormats, or malformed record/datum sizing in XRecord) that the parser walks past. Limiting factors: default setups connecting only to a local, trusted X server are not exposed; realistic exposure comes from untrusted-display scenarios such as X11 forwarding to or from an attacker-controlled host; and the demonstrated impact is a client crash (denial of service), not code execution, which bounds the severity.

No CVSS vector, EPSS score, KEV entry, or POC indicator was supplied for CVE-2026-109090 specifically, so quantitative exploitation signals are absent and there is no public exploit identified at time of analysis. The vulnerability belongs to an aggregated X.Org advisory (Oct 16, 2026) covering client-side memory-safety flaws in the X client libraries; the linked diffs tie this ID to libXrender (bounds hardening in XRenderQueryFormats) and libXtst (OOB/livelock fix in XRecord parse_reply_call_callback, a follow-up to CVE-2016-7952). Across the itemized sibling CVEs the pattern is consistent: a malicious or compromised X server sends a crafted reply that drives an out-of-bounds read (or, for one XKB case, an out-of-bounds write) in the client, yielding a client crash - availability impact, rated MEDIUM 5.3-6.5. The decisive risk limiter is the inverted trust model: these are client-side bugs triggered by a hostile server, whereas X clients normally trust the server they connect to, so exploitation requires luring a client to an attacker-controlled display. That makes this a real-but-modest-priority patch: ubiquitous library, but availability-only impact and an elevated-trust precondition keep real-world risk low rather than critical. CAVEAT: the input bundles many CVEs and does not itemize CVE-2026-109090 individually, so its exact component and precise impact are inferred from the linked diffs and should be verified against the per-CVE NVD/X.Org entry.

An attacker stands up or compromises an X server (for example a hostile display reached via X11 forwarding or an untrusted remote session) and waits for a victim to run an X client linked against libXrender or libXtst. When the client issues a normal request, the malicious server returns a crafted reply with inconsistent length or count fields, driving an out-of-bounds read during parsing and crashing the client. No public exploit code has been identified at time of analysis.