Вернуться к предупреждениям о безопасности

LibXtst Security Update — AlmaLinux 8 (ALSA-2026:91294)

ALSA-2026:91294 updates libXtst on AlmaLinux 8, fixing CVE-2026-94286 — a denial-of-service out-of-bounds read (CWE-126) in the RECORD extension reply parser, rated CVSS 7.1. Update with dnf update libXtst on systems with the library installed.

High 7.1 CVSS 2026-10-28

AlmaLinux 8

Что это значит по лицензии SharedLicense

An out-of-bounds read in the RECORD reply parser lets a malicious X server crash client applications that use the accessibility testing extension — a reliability and information-exposure risk in VDI-style setups.

Type:

security

Severity:

important

Release date:

2026-10-28

Description:

X.Org X11 libXtst runtime library

Security Fix(es):

* libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser (CVE-2026-94286)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	libXtst-1.2.3-8.el8_10.aarch64.rpm	13a71ce4acbd9e2d3f5c49885f91e962f3a93c944244edd95e9f7b3dc6c9d18a
aarch64	libXtst-devel-1.2.3-8.el8_10.aarch64.rpm	fa3b1d93e8f80909935bb0fec5e0691a174f617fbed9ba9f23be56f37d1e20aa
i686	libXtst-devel-1.2.3-8.el8_10.i686.rpm	3d82703e6f9aba9ad8f9a035c4c447c3e9b0e543841959d0beaa6a3e3b1bda41
i686	libXtst-1.2.3-8.el8_10.i686.rpm	65ae774f3bf4c1ebb077d4c31e3a89f03d09f22868c01af52e1f37e994a3b4f7
ppc64le	libXtst-1.2.3-8.el8_10.ppc64le.rpm	0705bd5a78d7488f645bd12c4d618719fe48cbdc3e011b0a732d40271db37108
ppc64le	libXtst-devel-1.2.3-8.el8_10.ppc64le.rpm	7283e6065fc27a3b968ae400cdbdef08b8a3c7e7aa1a05b617b4fa28d8742109
s390x	libXtst-devel-1.2.3-8.el8_10.s390x.rpm	1679850a1e35ec154e02d6f4e6da43b12bd10038fe2f84824cc8886c5d815a40
s390x	libXtst-1.2.3-8.el8_10.s390x.rpm	9ab1524f068425c5dc636356545a2a5ba109b1e187409d70b4c1320db6d5ca4a
x86_64	libXtst-1.2.3-8.el8_10.x86_64.rpm	4e3a08d81221d8a4c9158dc76ab26a4f25643c9220762e7cf2bc41b26d0956f2
x86_64	libXtst-devel-1.2.3-8.el8_10.x86_64.rpm	5cc094ecdf766eb9f3f8a96bb176b5f4da40d26ad5dc83153b4262e7f2c54485

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Часто задаваемые вопросы

What is CVE-2026-94286?

It is a denial-of-service out-of-bounds read (CWE-126) in libXtst's RECORD extension reply parser, rated CVSS 7.1 and fixed in the AlmaLinux 8 update ALSA-2026:91294.

Who is affected?

Systems with libXtst installed where X applications connect to an X server — libXtst is used for accessibility testing and synthetic input, so desktop and VDI images carry it more often than headless servers.

How do I apply the fix?

Run dnf update libXtst and restart X applications. On headless servers where it is installed but unused, removing it removes the surface.

Is this related to the libXrender fix?

It arrived in the same X11 library security window (ALSA-2026:91267 for libXrender) but is a separate flaw in a separate library — apply both updates together.

Источники

Предупреждения о безопасности

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему

Часто задаваемые вопросы

Похожие предупреждения

Проверьте систему на уязвимости