What is the CVSS score of CVE-2026-94283?

CVE-2026-94283 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-94283?

Yes, a patch is available for CVE-2026-94283. Update the affected software to the latest version immediately.

libX11 CVE-2026-94283

EUVD-2026-88174 MEDIUM

Out-of-bounds Read (CWE-125)

2026-09-28 suse

GHSA-j5qx-6vm4-vfcj

Buffer Overflow Red Hat Suse X Org Libx11

6.5

CVSS 3.1 · Vendor: suse

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure client to malicious X server
Exploit

Send crafted XIM attribute response
Execution

Trigger out-of-bounds read in libX11 parser
Impact

Crash attached X client (DoS)

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim's X11 client (linked against libX11 before 1.8.14) to connect to a malicious or compromised X server, which then returns crafted XIM (X Input Method) attribute data parsed by the vulnerable attribute parser. The limiting factor is this inverted trust relationship: clients normally connect only to a trusted local or forwarded display, so an attacker must control the X server the client attaches to (e.g., a hostile remote display, a compromised X11-forwarding endpoint, or a spoofed DISPLAY). Impact is limited to crashing the client (availability), with no code execution or data disclosure demonstrated.
Impact	The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: impact is availability-only (client crash / denial of service), with no confidentiality or integrity impact despite the CWE-125 out-of-bounds READ classification. The 'reverse' threat model is the key nuance - this is not a client attacking a server, but a malicious or compromised X server attacking the X clients that attach to it, which is why UI:R is present (a client must connect to the hostile server). No EPSS score, no CISA KEV entry, and no public POC were supplied, so exploitation status is 'no public exploit identified at time of analysis.' A patch is confirmed available (freedesktop GitLab MR 310, commit 42d0303f). Net assessment: this is a moderate, DoS-only issue whose real-world risk is bounded by the unusual precondition (trusting a malicious X server) and the availability-only impact. It is not a high-priority, mass-exploitable flaw; it warrants routine patching via distro updates rather than emergency response. Note the input tags 'Information Disclosure' and 'Buffer Overflow' overstate impact - the confirmed effect is a crash, not data disclosure or memory corruption/write.
Exploit ScenarioDerived	A user connects an X11 client (e.g., via SSH X11 forwarding or to a remote/attacker-controlled display) to a malicious X server. The server returns crafted XIM (X Input Method) attribute data that the client's libX11 attribute parser reads out of bounds, crashing the client application. No public exploit code was identified, and the impact is limited to denial of service (application crash).

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 28, 2026

Remote, unauthenticated attackers who control an X server can crash X clients linked against libX11 before 1.8.14 by returning crafted XIM (X Input Method) attribute data, because the parser performs an out-of-bounds read (CWE-125). This is an availability-only denial-of-service (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) limited by an inverted trust relationship: the victim's client must attach to the attacker's display, so exploitation requires the user to connect to a malicious, compromised, or spoofed X server. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.

RemediationAI

Upgrade to libX11 1.8.14 or later; the upstream fix is available as a merge request (commit 42d0303f243002a9856c76060569a61893c670dd) at https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=42d0303f243002a9856c76060569a61893c670dd. If immediate upgrade is not possible, restrict X11 clients to trusted local or authenticated SSH-forwarded displays, avoid setting DISPLAY to untrusted hosts, and prevent X11 forwarding to remote endpoints that are not fully trusted. Monitor for repeated client crashes in XIM-enabled applications as a potential indicator of a hostile X server. Disabling XIM support or input methods can remove the attack surface but will break input for non-Latin scripts and complex text entry, so it is a temporary workaround rather than a long-term fix.

Affected VersionsENISA

libX11 0 <1.8.14

Affected Packages

euvd libx11 fix: 1.8.14

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

libX11 is the reference client-side implementation of the X11 protocol. XIM (X Input Method) lets clients negotiate input methods with an X server, exchanging attribute lists that the client parses to configure locale and input handling. CVE-2026-94283 is an out-of-bounds read (CWE-125) in that attribute parser: a malicious X server returns malformed XIM attribute data that causes the client to read beyond the intended buffer, leading to a crash (denial of service) on the client. The CPE cpe:2.3:a:x.org:libx11:*:*:*:*:*:*:*:* covers all libX11 versions before the fix. Although tags include 'Information Disclosure' and 'Buffer Overflow', the authoritative assessment finds no demonstrated data disclosure or code execution; the practical impact is availability loss on the attached client. The patch is an upstream merge request (commit 42d0303f243002a9856c76060569a61893c670dd) at https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=42d0303f243002a9856c76060569a61893c670dd.

Know when Libx11 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (suse) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI 6.5 MEDIUM

Malicious X server reaches clients over the network (AV:N) and the client must actively connect to it (UI:R); out-of-bounds read causes a crash only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE MEDIUM

Red Hat 6.5 MEDIUM

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Prevalence

High

core X11 client library present on virtually all Linux/Unix desktop systems

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Libx11

View all

CVE-2021-31535 CRITICAL Act Now POC

9.8 May 27

LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. R

CVE-2020-14363 HIGH This Week POC

7.8 Sep 11

An integer overflow vulnerability leading to a double-free was found in libX11. Rated high severity (CVSS 7.8), this vul

CVE-2016-7942 CRITICAL Act Now

9.8 Dec 13

The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involvin

CVE-2016-7943 CRITICAL Act Now

9.8 Dec 13

The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involvi

CVE-2018-14600 CRITICAL Act Now

9.8 Aug 24

An issue was discovered in libX11 through 1.6.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl

CVE-2018-14599 CRITICAL Act Now

9.8 Aug 24

An issue was discovered in libX11 through 1.6.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl

CVE-2013-7439 HIGH This Week

7.5 Apr 16

Multiple off-by-one errors in the (1) MakeBigReq and (2) SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11

CVE-2023-43787 HIGH This Week

7.8 Oct 10

A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. Rated high severity (

CVE-2026-88806 HIGH This Week

7.5 Sep 21

Heap-based buffer overflow in libX11 before 1.8.14 allows a malicious or compromised X server to corrupt memory in conne

CVE-2023-3138 HIGH This Week

7.5 Jun 28

A vulnerability was found in libX11. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no auth

CVE-2018-14598 HIGH This Week

7.5 Aug 24

An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. Rated high severity (CVSS 7.5), this vu

CVE-2013-1981 MEDIUM This Month

6.8 Jun 15

Multiple integer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to trigger allocation of ins

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2025-5777 CRITICAL POC

9.3

CVE-2016-1646 HIGH POC

8.8

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Container bci/openjdk-devel:17.0.20.1-21.73 Container bci/openjdk-devel:21.0.12.1-25.73 Container bci/openjdk-devel:25.0.4.1-9.74 Container bci/openjdk:17.0.20.1-20.63 Container bci/openjdk:21.0.12.1-24.62 Container bci/openjdk:25.0.4.1-9.62 Container private-registry/1.2/harbor-portal:1.2.1-1.126 Container private-registry/harbor-portal:1.1.3-2.147 Image SLES15-SP7-Azure-Basic	Affected
Container suse/kiosk/firefox-esr:153.3-75.48 Container suse/kiosk/pulseaudio:17.0-73.45 Container suse/kiosk/tigervnc-x11vnc:1.14-63.46 Container suse/kiosk/xorg-client:21-81.10 Container suse/kiosk/xorg:21.1-83.45	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed

References

Advisories & patches

PATCH https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=42d0303f243002a9856c76060569a61893c670dd ADVISORY https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/924fc91f0 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxrender/-/commit/0564bce54 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/ac60f5f47 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-94283 ADVISORY https://seclists.org/oss-sec/2026/q4/212 ADVISORY https://ubuntu.com/security/notices/USN-8913-1 ADVISORY https://vuldb.com/vuln/411002 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4410/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4500/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4501/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4502/

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back