What is the CVSS score of CVE-2026-94284?

CVE-2026-94284 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-94284?

Yes, a patch is available for CVE-2026-94284. Update the affected software to the latest version immediately.

libX11 CVE-2026-94284

EUVD-2026-88175 MEDIUM

Out-of-bounds Read (CWE-125)

2026-09-28 suse

GHSA-5j4r-gpq7-9www

Buffer Overflow Red Hat Suse X Org Libx11

5.5

CVSS 3.1 · Vendor: suse

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure client to malicious X server
Exploit

Send crafted XIM trigger-key registration data
Execution

Trigger out-of-bounds read in parser
Impact

Crash attached X client (DoS)

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires an X11 client built against a vulnerable libX11 (before 1.8.14) to connect to a malicious or compromised X server, and the client must use the X Input Method (XIM) path that performs trigger-key registration parsing. The limiting factors are significant: the trust model is inverted (server attacks client), so an attacker must control the X server the victim connects to (e.g., a hostile remote display, malicious SSH X-forwarding endpoint, or attacker-set DISPLAY), user interaction is needed to establish that connection (UI:R), and the vector is local (AV:L) rather than network-facing. Impact is limited to crashing the affected client application (availability only).
Impact	This is a medium-severity denial-of-service issue, not a high-priority remote code execution flaw. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5) is internally consistent with the description: the attack vector is local (AV:L) because exploitation occurs over an X11 connection where the X client must connect to a malicious/compromised X server, user interaction is required (UI:R) for that connection to be established, and the only impact is availability (A:H, client crash) with no confidentiality or integrity loss (C:N/I:N). Notably, although CWE-125 (out-of-bounds READ) and the 'Information Disclosure' tag might suggest data leakage, the vendor-scored vector explicitly sets C:N and the description states only that clients can be crashed - so the demonstrated impact is DoS, and the 'Information Disclosure' framing is misleading. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The inverted trust model (a malicious server attacking clients) further limits practical risk: it typically requires a user to be induced to connect a client to an attacker-controlled X server, which is uncommon in normal desktop use. Net: a real but low-urgency bug worth patching in routine cycles rather than emergency response.
Exploit ScenarioDerived	A user is induced to run an X11 client application against an attacker-controlled or compromised X server (for example via a manipulated DISPLAY, an SSH X-forwarding session to a hostile host, or a malicious remote display). During XIM trigger-key registration the malicious server returns crafted data that drives the client's parser to read out of bounds, crashing the client application. No public exploit code is identified in the provided intelligence; a vendor patch (freedesktop MR 310) is available.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 28, 2026

Crashing of X11 client applications can be triggered by a malicious X server exploiting an out-of-bounds read in libX11's X Input Method (XIM) trigger-key registration parser in versions before 1.8.14. This is a medium-severity denial-of-service issue (CVSS 5.5) that requires the victim to connect to an attacker-controlled X server, with user interaction (UI:R) and no authentication required (PR:N), but impact is limited to availability (client crash). No public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).

RemediationAI

Upgrade to libX11 1.8.14 or later (Vendor-released patch: libX11 1.8.14), which contains the fix from X.Org libX11 merge request 310 (https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=1b7904002d212eed40949ccf4e8e7156f9fec0e2). As compensating controls, avoid connecting X11 clients to untrusted or attacker-controlled X servers (e.g., hostile remote displays, untrusted SSH X-forwarding endpoints, or attacker-set DISPLAY variables); this may limit remote GUI functionality. Another mitigation is to disable the XIM trigger-key registration path if the application does not require it, though this can degrade input method support. There is no indication that network-level blocking is applicable since the attack vector is local. Apply the patch as the primary remediation.

Affected VersionsENISA

libX11 0 <1.8.14

Affected Packages

euvd libx11 fix: 1.8.14

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is an out-of-bounds read (CWE-125) in libX11, the core X11 client library used by applications to communicate with X servers. Specifically, the flaw resides in the parser that handles trigger-key registration messages as part of the X Input Method (XIM) protocol. When an X client connects to a malicious or compromised X server, the server can send a crafted XIM message that causes the client to read beyond allocated memory, leading to a crash. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates a local attack vector requiring user interaction, no privileges, and only availability impact. The affected CPE is cpe:2.3:a:x.org:libx11:*:*:*:*:*:*:*:* for versions prior to 1.8.14. This is an inverted trust model where the server attacks the client, and exploitation is limited to denial of service.

Know when Libx11 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (suse) PRIMARY 5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI 5.5 MEDIUM

Local X11 connection to a malicious server (AV:L), victim must initiate the client connection (UI:R), no auth on client side (PR:N), impact limited to client crash (A:H, C:N/I:N).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE MEDIUM

Red Hat 5.5 MEDIUM

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.

Threat Intelligence Overview

EPSS Score

0.1%

Top 99% exploitable

Prevalence

High

libX11 is the core X11 client library on virtually all Linux/Unix desktops

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact· derived

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Libx11

View all

CVE-2021-31535 CRITICAL Act Now POC

9.8 May 27

LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. R

CVE-2020-14363 HIGH This Week POC

7.8 Sep 11

An integer overflow vulnerability leading to a double-free was found in libX11. Rated high severity (CVSS 7.8), this vul

CVE-2016-7942 CRITICAL Act Now

9.8 Dec 13

The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involvin

CVE-2016-7943 CRITICAL Act Now

9.8 Dec 13

The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involvi

CVE-2018-14600 CRITICAL Act Now

9.8 Aug 24

An issue was discovered in libX11 through 1.6.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl

CVE-2018-14599 CRITICAL Act Now

9.8 Aug 24

An issue was discovered in libX11 through 1.6.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl

CVE-2013-7439 HIGH This Week

7.5 Apr 16

Multiple off-by-one errors in the (1) MakeBigReq and (2) SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11

CVE-2023-43787 HIGH This Week

7.8 Oct 10

A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. Rated high severity (

CVE-2026-88806 HIGH This Week

7.5 Sep 21

Heap-based buffer overflow in libX11 before 1.8.14 allows a malicious or compromised X server to corrupt memory in conne

CVE-2023-3138 HIGH This Week

7.5 Jun 28

A vulnerability was found in libX11. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no auth

CVE-2018-14598 HIGH This Week

7.5 Aug 24

An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. Rated high severity (CVSS 7.5), this vu

CVE-2013-1981 MEDIUM This Month

6.8 Jun 15

Multiple integer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to trigger allocation of ins

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2025-5777 CRITICAL POC

9.3

CVE-2016-1646 HIGH POC

8.8

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Container bci/openjdk-devel:17.0.20.1-21.73 Container bci/openjdk-devel:21.0.12.1-25.73 Container bci/openjdk-devel:25.0.4.1-9.74 Container bci/openjdk:17.0.20.1-20.63 Container bci/openjdk:21.0.12.1-24.62 Container bci/openjdk:25.0.4.1-9.62 Container private-registry/1.2/harbor-portal:1.2.1-1.126 Container private-registry/harbor-portal:1.1.3-2.147 Image SLES15-SP7-Azure-Basic	Affected
Container suse/kiosk/firefox-esr:153.3-75.48 Container suse/kiosk/pulseaudio:17.0-73.45 Container suse/kiosk/tigervnc-x11vnc:1.14-63.46 Container suse/kiosk/xorg-client:21-81.10 Container suse/kiosk/xorg:21.1-83.45	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed

References

Advisories & patches

PATCH https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=1b7904002d212eed40949ccf4e8e7156f9fec0e2 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/924fc91f0 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxrender/-/commit/0564bce54 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/ac60f5f47 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-94284 ADVISORY https://seclists.org/oss-sec/2026/q4/212 ADVISORY https://ubuntu.com/security/notices/USN-8913-1 ADVISORY https://vuldb.com/vuln/411006 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4410/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4500/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4501/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4502/

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back