CVE-2026-109088

A flaw was found in libXtst. A malicious X server can send malformed RECORD EnableContext replies to a connected client. When processing these malformed responses, the client enters an infinite loop, resulting in a Denial of Service (DoS) condition where the application becomes unresponsive.

This vulnerability is rated Moderate because triggering the condition requires an X11 client application to connect to an untrusted or compromised X server, limiting the blast radius to a localized application hang. In typical Red Hat Enterprise Linux environments, client applications communicate exclusively with trusted local display servers, substantially mitigating exposure under default configurations. Furthermore, successful exploitation results only in the client process looping indefinitely, without compromising data confidentiality or system integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.