What is the CVSS score of CVE-2026-88806?

CVE-2026-88806 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-88806?

Within 24 hours, inventory all Linux, Unix, and virtual desktop images for their installed libX11 version and flag any system below 1.8.14. Within 7 days, deploy the vendor-released patch - libX11 1.8.14 - through your standard configuration management or package repositories, prioritizing engineering workstations, thin-client and VDI images, and any host that uses X11 forwarding or connects to remote or third-party X display servers; where patching must be staged, temporarily restrict outbound X11 connections to known-trusted hosts. Within 30 days, confirm full fleet coverage via authenticated scanning or software inventory, rebuild golden images so new deployments ship with libX11 1.8.14 or later, and add a control requiring review before users connect to external X servers.

libX11 CVE-2026-88806

Q: Which versions of libX11 are affected by CVE-2026-88806?

A memory-corruption flaw in libX11 (versions before 1.8.14) can crash or compromise the X11 client software running on employee workstations and virtual desktops, but only when the user connects to…. A patch is available.

EUVD-2026-83914 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-09-21 suse

GHSA-xrgw-w7v2-3qp8

Buffer Overflow Heap Overflow Red Hat Suse X Org Libx11

7.5

CVSS 3.1 · Vendor: suse

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Set up malicious X server
Delivery

Lure client to connect to display
Exploit

Client sends XkbGetMap request
Execution

Server returns crafted keymap reply
Persist

Overflow key_sym_map heap buffer
Impact

Execute code in client process

Vulnerability Assessment

Weakness	CWE CWE-122 ASVS 5.0 V15 - Secure Coding and Architecture Heap buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim X11 client (linked against libX11 before 1.8.14) to connect to an attacker-controlled or compromised X server and to trigger an XkbGetMap request whose malicious reply overflows key_sym_map. The limiting factors are significant: this is a client-side (reverse) attack, so the attacker must control the X server the client talks to - not a normal remote-server-facing exposure - and the CVSS marks UI:R (user must initiate the connection) and AC:H (crafting a reliable overflow/exploit primitive is non-trivial). It is not exploitable against a default client that only connects to trusted local/known displays; risk arises in scenarios like remote/forwarded X sessions, untrusted display forwarding, or connecting to attacker-influenced X servers.
Impact	The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.5 High) describes an INVERTED threat model: libX11 is a client-side library, so the 'attacker' is a malicious or compromised X server, and the victim is the X11 client application/user that connects to it (UI:R). This is not a server-facing remote attack - it requires the victim to actively connect to a hostile display, which is why AC:H and UI:R are present and why the practical exposure is far narrower than the network vector alone suggests. Exploitation signals are weak-to-absent: no CISA KEV listing, no EPSS score provided, and no POC referenced - only a vendor merge request (patch). SSVC/automatable data is not supplied. The C:H/I:H/A:H impact reflects heap buffer overflow (CWE-122) potential for memory corruption and possibly code execution in the client process, but that ceiling is bounded by the difficulty of luring a client to a malicious server and winning the memory-corruption primitive. Net: a legitimate memory-safety bug worth patching in the X.Org stack, but the real-world urgency is moderate - no evidence of exploitation, high attack complexity, and a non-default 'connect to attacker's X server' precondition. This is a patch-in-normal-cycle issue rather than an emergency, absent any KEV/POC change.
Exploit ScenarioDerived	An attacker stands up a malicious or trojaned X server (or MITM/compromises a display an X11 client is directed to) and waits for a victim client to connect. When the client issues an XkbGetMap request, the malicious server returns a crafted keyboard-mapping reply whose fields cause libX11 to overflow the heap-allocated key_sym_map buffer, corrupting client memory and potentially leading to code execution in the client's context. No public exploit is identified at time of analysis; only the vendor patch (merge request 309) is referenced.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 21, 2026

Heap-based buffer overflow in libX11 before 1.8.14 allows a malicious or compromised X server to corrupt memory in connecting X11 clients via a crafted XkbGetMap reply that overflows the key_sym_map. This client-side vulnerability has an inverted threat model: the attacker must control the X server the victim connects to, with exploitation requiring user interaction (UI:R) and high attack complexity (AC:H). CVSS 3.1 score is 7.5 High; no public exploit code has been identified at time of analysis.

RemediationAI

Upgrade to libX11 version 1.8.14 or later. The upstream fix is provided in merge request 309 (https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309), and vendor patches are available. If immediate upgrade is not possible, restrict X11 clients from connecting to untrusted or attacker-controlled X servers. Specific mitigations include avoiding X11 forwarding from untrusted remote hosts, disabling remote X connections (e.g., using 'xhost -' and not allowing TCP connections), and using SSH X11 forwarding only to trusted servers. Note that these restrictions may break legitimate remote GUI access; they should be applied based on risk tolerance. No alternative workarounds are known at this time.

Affected VersionsENISA

libX11 0 <1.8.14

Affected Packages

euvd libx11 fix: 1.8.14

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

libX11 is the client-side library for the X Window System. The XkbGetMap request is part of the X Keyboard Extension (XKB) protocol, used by clients to retrieve keyboard mapping information from the X server. In affected versions, the client fails to properly validate the length of the key_sym_map array in the server's reply, leading to a heap-based buffer overflow (CWE-122). An attacker-controlled X server can send a malicious reply that overflows the heap buffer, corrupting adjacent memory. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that the attack is network-reachable (the client connects to the server), requires high complexity to craft a reliable exploit, needs user interaction to initiate the connection, and can result in high confidentiality, integrity, and availability impact. The CPE cpe:2.3:a:x.org:libx11:*:*:*:*:*:*:*:* indicates all versions are potentially affected, with the fix introduced in version 1.8.14 via merge request 309.

Know when Libx11 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (suse) PRIMARY 7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 7.5 HIGH

Malicious X server reaches the client over the X protocol (AV:N) but the victim must connect (UI:R) and the overflow is hard to weaponize (AC:H); heap corruption yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.

Executive ViewAI

Why It Matters

A memory-corruption flaw in libX11 (versions before 1.8.14) can crash or compromise the X11 client software running on employee workstations and virtual desktops, but only when the user connects to an X server controlled by an attacker. Because exploitation requires tricking a user into connecting to a hostile or already-compromised display server and is technically difficult to achieve reliably, the practical exposure for most managed endpoints is limited, while environments that routinely connect to untrusted or third-party X servers carry elevated risk. Leadership should treat this as a client-side resilience and patch-hygiene issue affecting Linux/Unix desktop fleets rather than a widespread remote compromise of corporate servers.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Prevalence

High

core X.Org client library on virtually all Linux/BSD desktop systems

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

Medium

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

More in Libx11

View all

CVE-2021-31535 CRITICAL Act Now POC

9.8 May 27

LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. R

CVE-2020-14363 HIGH This Week POC

7.8 Sep 11

An integer overflow vulnerability leading to a double-free was found in libX11. Rated high severity (CVSS 7.8), this vul

CVE-2016-7942 CRITICAL Act Now

9.8 Dec 13

The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involvin

CVE-2016-7943 CRITICAL Act Now

9.8 Dec 13

The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involvi

CVE-2018-14600 CRITICAL Act Now

9.8 Aug 24

An issue was discovered in libX11 through 1.6.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl

CVE-2018-14599 CRITICAL Act Now

9.8 Aug 24

An issue was discovered in libX11 through 1.6.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl

CVE-2013-7439 HIGH This Week

7.5 Apr 16

Multiple off-by-one errors in the (1) MakeBigReq and (2) SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11

CVE-2023-43787 HIGH This Week

7.8 Oct 10

A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. Rated high severity (

CVE-2023-3138 HIGH This Week

7.5 Jun 28

A vulnerability was found in libX11. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no auth

CVE-2018-14598 HIGH This Week

7.5 Aug 24

An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. Rated high severity (CVSS 7.5), this vu

CVE-2013-1981 MEDIUM This Month

6.8 Jun 15

Multiple integer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to trigger allocation of ins

CVE-2013-1997 MEDIUM This Month

6.8 Jun 15

Multiple buffer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to cause a denial of service

Same weakness CWE-122 – Heap-based Buffer Overflow

View all

CVE-2023-4911 HIGH POC

7.8

CVE-2023-27997 CRITICAL

9.8

CVE-2026-94127 CRITICAL POC

9.3

CVE-2025-25249 CRITICAL POC

9.8

CVE-2026-85880 HIGH POC

7.8

CVE-2025-24985 HIGH POC

7.8

CVE-2026-53362 HIGH POC

7.8

CVE-2025-21418 HIGH

7.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
Container bci/openjdk-devel:17.0.20.1-21.73 Container bci/openjdk-devel:21.0.12.1-25.73 Container bci/openjdk-devel:25.0.4.1-9.74 Container bci/openjdk:17.0.20.1-20.63 Container bci/openjdk:21.0.12.1-24.62 Container bci/openjdk:25.0.4.1-9.62 Container private-registry/1.2/harbor-portal:1.2.1-1.126 Container private-registry/harbor-portal:1.1.3-2.147 Image SLES15-SP7-Azure-Basic	Affected
Container suse/kiosk/firefox-esr:153.3-75.48 Container suse/kiosk/pulseaudio:17.0-73.45 Container suse/kiosk/tigervnc-x11vnc:1.14-63.46 Container suse/kiosk/xorg-client:21-81.10 Container suse/kiosk/xorg:21.1-83.45	Affected
Container suse/nginx:1.27-21.14	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed

References

Advisories & patches

PATCH https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/924fc91f0 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxrender/-/commit/0564bce54 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/ac60f5f47 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-88806 ADVISORY https://seclists.org/oss-sec/2026/q4/212 ADVISORY https://ubuntu.com/security/notices/USN-8913-1 ADVISORY https://vuldb.com/vuln/408112 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23885/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23899/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4410/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4500/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4501/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4502/

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back