CVE-2026-88806

A flaw was found in libX11. A heap-based buffer overflow vulnerability exists during the handling of XkbGetMap replies. A remote attacker, by operating a malicious X server, could exploit this flaw to potentially execute arbitrary code or cause a denial of service on the client system. User interaction is required for exploitation.

Red Hat Product Security rates this vulnerability as Important because an attacker operating a rogue or compromised X server can trigger memory corruption, potentially leading to arbitrary code execution with the permissions of the connecting client application. In typical Red Hat Enterprise Linux deployments, graphical applications communicate over trusted local sockets to the local display server, substantially restricting attack vectors. However, risk increases in scenarios where users connect to untrusted remote displays or employ unverified remote X11 session forwarding.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid connecting to untrusted X servers. When using SSH, ensure that X11 forwarding (ssh -X or ssh -Y) is only enabled for trusted remote hosts. To prevent X11 forwarding for specific hosts, add ForwardX11 no to the relevant host entry in ~/.ssh/config or /etc/ssh/ssh_config. Alternatively, disable X11 forwarding globally by setting ForwardX11 no in /etc/ssh/ssh_config.