What is the CVSS score of CVE-2026-94285?

CVE-2026-94285 has a CVSS 3.1 base score of 5.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-94285?

Yes, a patch is available for CVE-2026-94285. Update the affected software to the latest version immediately.

libX11 CVE-2026-94285

EUVD-2026-88177 MEDIUM

Out-of-bounds Read (CWE-125)

2026-09-28 suse

GHSA-f73h-qw9f-3h88

Buffer Overflow Information Disclosure Red Hat Suse X Org Libx11

5.1

CVSS 3.1 · Vendor: suse

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker controls malicious X server
Delivery

Victim X client connects to server
Exploit

Server returns crafted codeset data
Execution

OOB read in libX11 byte-oriented codeset parser
Impact

Client process crashes (DoS)

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a victim application linked against libX11 (before 1.8.14) to establish an X11 connection to an X server that the attacker controls or has compromised; the malicious server then supplies crafted byte-oriented codeset/locale data that the client's parser processes. Limiting factors: the attack works in the reverse trust direction (server against client), so it is only realistic where clients connect to untrusted or attacker-influenced X servers (e.g. hostile remote/forwarded X displays); the local attack vector (AV:L) reflects the X protocol channel rather than arbitrary internet reach, and the maximal impact is a client crash with only incidental memory disclosure, not code execution.
Impact	This is a genuine but low-severity issue best characterized as a client-side denial of service. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, base 5.1) reflects that the attack is not a classic remote-server compromise: the trust direction is reversed - a MALICIOUS or compromised X SERVER attacks the X CLIENTS connecting to it via an out-of-bounds read in libX11's byte-oriented codeset parser. Impact is dominated by availability (client crash, A:L) with only a theoretical minor confidentiality leak (C:L) inherent to an OOB read; there is no integrity impact and no code execution claimed. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis'. There is no signal conflict of concern, but note the practical exposure is limited: exploitation requires the victim client to connect to an attacker-controlled X server, which is not the normal deployment posture. Real-world priority is LOW-to-MEDIUM despite the very high deployment footprint of libX11, because the worst realistic outcome is an application crash rather than data theft or code execution.
Exploit ScenarioDerived	An attacker who controls or has compromised an X server (for example a rogue display exported to victims, or an X connection tunneled to a hostile endpoint) sends crafted codeset/locale data that the victim's libX11-linked client parses. The byte-oriented codeset parser reads out of bounds and the client application crashes. No public proof-of-concept is identified in the provided data; the crash is local to the client process (S:U), with only incidental potential to disclose adjacent memory.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 28, 2026

Malicious or compromised X servers can crash X clients linked against libX11 before 1.8.14 by supplying crafted byte-oriented codeset/locale data that triggers an out-of-bounds read in the client's codeset parser. The flaw is a client-side denial of service with only incidental memory disclosure, not code execution, and it works in the reverse of the usual trust direction: the server attacks the client, so exposure requires a victim application to open an X11 connection to an X server the attacker controls or has compromised (such as a hostile remote or forwarded display). The local attack vector and the requirement for an untrusted display keep realistic risk low; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available (upstream fix merged for the 1.8.14 release).

RemediationAI

Apply the vendor-released fix by upgrading to libX11 1.8.14 or later; the upstream change is carried in merge request 310 (commit 980868483446f24f9658d26aa5bfa42f3da6dd3a) at https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=980868483446f24f9658d26aa5bfa42f3da6dd3a, so distributions should update their libX11 packages to a build containing that commit and rebuild dependent X clients. Where patching is delayed, the effective control is to avoid connecting X clients to X servers you do not control or trust: disable SSH X11 forwarding (ForwardX11 no in ssh_config or omit -X/-Y), restrict display access with xauth/MIT-MAGIC-COOKIE so a hostile server cannot be reached through a shared or forwarded display, and isolate untrusted GUI sessions inside a nested or virtual display (Xephyr, Xpra, or a Wayland/XWayland sandbox) so any crash is contained to the isolated server rather than the host client - the trade-off being reduced convenience for legitimate remote GUI use. Running clients under a UTF-8 locale is sometimes suggested because it avoids the byte-oriented codeset path that contains the flaw, but this is an unverified heuristic rather than a guaranteed mitigation and should not replace patching. No workaround fully removes the risk, since the defect is in library code executed on the client at connection time.

Affected VersionsENISA

libX11 0 <1.8.14

Affected Packages

euvd libx11 fix: 1.8.14

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

libX11 is the reference client-side implementation of the X11 protocol. When an X client connects to a display it performs locale and codeset negotiation, and Xlib's byte-oriented codeset parser (used for non-UTF-8, single-byte or legacy multibyte encodings rather than UTF-8 locales) processes data supplied by the server. CVE-2026-94285 is a CWE-125 out-of-bounds read in that parser: the code trusts server-provided codeset data without adequately validating lengths or indices, so a crafted response can cause Xlib to read past the end of a buffer, producing a crash and potentially leaking adjacent memory contents into client processing. The affected component is identified by CPE cpe:2.3:a:x.org:libx11:*:*:*:*:*:*:*:*, i.e. the x.org libX11 library prior to the 1.8.14 fix boundary, which means every application dynamically or statically linked against that library inherits the parsing path. The reversal of trust is the notable design detail: the X server, normally treated as the trusted display provider, is the attacker here, which is why the assessed vector is local (AV:L) despite no authentication (PR:N) or user interaction (UI:N) being required once a connection to the hostile server exists.

Know when Libx11 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (suse) PRIMARY 5.1 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

vuln.today AI 5.1 MEDIUM

Malicious X server reaches the client over the X protocol channel (AV:L), no auth or interaction beyond the connection (PR:N/UI:N); OOB read yields minor disclosure (C:L) and a crash (A:L), no integrity impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE MEDIUM

Red Hat 5.1 MEDIUM

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

DescriptionCVE.org

An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.

Threat Intelligence Overview

EPSS Score

0.1%

Top 99% exploitable

Prevalence

High

core X11 client library on nearly all Linux/Unix desktops, though Wayland erodes reach

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact· derived

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Libx11

View all

CVE-2021-31535 CRITICAL Act Now POC

9.8 May 27

LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. R

CVE-2020-14363 HIGH This Week POC

7.8 Sep 11

An integer overflow vulnerability leading to a double-free was found in libX11. Rated high severity (CVSS 7.8), this vul

CVE-2016-7942 CRITICAL Act Now

9.8 Dec 13

The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involvin

CVE-2016-7943 CRITICAL Act Now

9.8 Dec 13

The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involvi

CVE-2018-14600 CRITICAL Act Now

9.8 Aug 24

An issue was discovered in libX11 through 1.6.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl

CVE-2018-14599 CRITICAL Act Now

9.8 Aug 24

An issue was discovered in libX11 through 1.6.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl

CVE-2013-7439 HIGH This Week

7.5 Apr 16

Multiple off-by-one errors in the (1) MakeBigReq and (2) SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11

CVE-2023-43787 HIGH This Week

7.8 Oct 10

A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. Rated high severity (

CVE-2026-88806 HIGH This Week

7.5 Sep 21

Heap-based buffer overflow in libX11 before 1.8.14 allows a malicious or compromised X server to corrupt memory in conne

CVE-2023-3138 HIGH This Week

7.5 Jun 28

A vulnerability was found in libX11. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no auth

CVE-2018-14598 HIGH This Week

7.5 Aug 24

An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. Rated high severity (CVSS 7.5), this vu

CVE-2013-1981 MEDIUM This Month

6.8 Jun 15

Multiple integer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to trigger allocation of ins

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2025-5777 CRITICAL POC

9.3

CVE-2016-1646 HIGH POC

8.8

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Container bci/openjdk-devel:17.0.20.1-21.73 Container bci/openjdk-devel:21.0.12.1-25.73 Container bci/openjdk-devel:25.0.4.1-9.74 Container bci/openjdk:17.0.20.1-20.63 Container bci/openjdk:21.0.12.1-24.62 Container bci/openjdk:25.0.4.1-9.62 Container private-registry/1.2/harbor-portal:1.2.1-1.126 Container private-registry/harbor-portal:1.1.3-2.147 Image SLES15-SP7-Azure-Basic	Affected
Container suse/kiosk/firefox-esr:153.3-75.48 Container suse/kiosk/pulseaudio:17.0-73.45 Container suse/kiosk/tigervnc-x11vnc:1.14-63.46 Container suse/kiosk/xorg-client:21-81.10 Container suse/kiosk/xorg:21.1-83.45	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed

References

Advisories & patches

PATCH https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=980868483446f24f9658d26aa5bfa42f3da6dd3a ADVISORY https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/924fc91f0 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxrender/-/commit/0564bce54 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/ac60f5f47 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-94285 ADVISORY https://seclists.org/oss-sec/2026/q4/212 ADVISORY https://ubuntu.com/security/notices/USN-8913-1 ADVISORY https://vuldb.com/vuln/411005 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4410/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4500/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4501/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4502/

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back