libX11-1.8.14 (Xorg library)

[Bruce Dubbs]

New point version.

[Joe Locash]

libX11 is the original client-side library for the core X11 protocol.

This release includes:

 * ximcp: bound XIM_OPEN_REPLY attribute lengths (CVE-2026-94283) (!310)
 * ximcp: bound XIM_REGISTER_TRIGGERKEYS keylist lengths (CVE-2026-94284) (!310)
 * lcGenConv: bound byteM_parse_codeset() reads (CVE-2026-94285) (!310)
 * xkb: Check the keysym range in _XkbReadKeyActions (CVE-2026-88806) (!309)
 * OpenDisplay: avoid NULL dereference in out-of-memory error path (!307)
 * XSetFontPath: zero-initialize packed font path buffer (#248, !306)
 * _XSend: treat xcb_writev returning 0 as failure (!305)
 * _XSend: discard the output buffer after an I/O error (!305)
 * XkbSetIndicatorMap: avoid undefined behavior due to left shift (#246, !304)
 * nls: Add ca_ES.UTF-8 at valencia locale (#234, !303)
 * Xutil.h: add include of Xresource.h (#242, !302)
 * xkb: fix incorrect size check when growing doodads in a section (!300)
 * XlibInt.c: use correct type for Win32 in SocketBytesReadable() (!299)
 * XlibInt.h: prevent Win32 CreateWindow macro from leaking into our code (!299)

For more information on the included security fixes, see the advisory at:
https://lists.x.org/archives/xorg-announce/2026-October/003752.html

Alan Coopersmith (9):
      XlibInt.h: prevent Win32 CreateWindow macro from leaking into our code
      XlibInt.c: use correct type for Win32 in SocketBytesReadable()
      Xutil.h: add include of Xresource.h
      nls: Add ca_ES.UTF-8 at valencia locale
      XkbSetIndicatorMap: avoid undefined behavior due to left shift overflow
      XSetFontPath: zero-initialize packed font path buffer
      XOpenDisplay: avoid NULL dereference in out-of-memory error path
      Revert "XGetSubImage: improve efficiency by reducing number of temporary allocations"
      libX11 1.8.14

Charles G Waldman (2):
      _XSend: discard the output buffer after an I/O error
      _XSend: treat xcb_writev returning 0 as failure

Mikhail Dmitrichenko (1):
      xkb: fix incorrect size check when growing doodads in a section

Olivier Fourdan (3):
      ximcp: bound XIM_OPEN_REPLY attribute lengths to the received packet
      ximcp: bound XIM_REGISTER_TRIGGERKEYS keylist lengths to the packet
      lcGenConv: bound byteM_parse_codeset() reads to remaining input length

Peter Hutterer (1):
      xkb: Check the keysym range in _XkbReadKeyActions (CVE-2026-88806)

qkot (1):
      XGetSubImage: improve efficiency by reducing number of temporary allocations

git tag: libX11-1.8.14

From: ​https://lists.x.org/archives/xorg-announce/2026-October/003752.html

========================================================================
libX11 - 4 CVEs
========================================================================

For those considering cherry-picking the fixes, note that libX11 1.8.14
also includes additional code hardening fixes without CVEs assigned
that you may also want to consider.

* CVE-2026-88806:
  Out-of-bounds write vulnerability in libX11's XKB (X Keyboard Extension)
  action parser.

  A malicious server could send a XkbGetMap reply with keycode values
  exceeding max_keycode + 1, causing a write past the end of the allocated
  array during reply handling.

  Fixed in: libX11 1.8.14
  Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/6d4432b13
  Found by: Adam Bedard working with TrendAI Zero Day Initiative (ZDI-CAN-32061)

* CVE-2026-94283:
  Out-of-bounds read vulnerability in libX11's XIM (X Input Method)
  attribute parser.

  A malicious or compromised XIM server can send a crafted XIM_OPEN_REPLY
  message with inconsistent nested attribute lengths, causing the client
  to read past the end of the received packet buffer during parsing.

  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 6.5 (MEDIUM)

  Fixed in: libX11 1.8.14
  Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/f263bbca2
  Found by: Aisle Research (AISLE-Report-PSIRTSUPT-15963)
  
* CVE-2026-94284:
  Out-of-bounds read vulnerability in libX11's XIM trigger-key
  registration parser.

  A malicious XIM server can send a crafted XIM_REGISTER_TRIGGERKEYS
  message with oversized inner on-keys/off-keys length fields, causing the
  client to read past the received buffer during memcpy() and crash.

  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 5.5 (MEDIUM)

  Fixed in: libX11 1.8.14
  Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/924fc91f0
  Found by: Aisle Research (AISLE-Report-PSIRTSUPT-16671)

* CVE-2026-94285:
  Out-of-bounds read in libX11's byte-oriented codeset parser.

  When the last byte of input is a valid lead byte for a multi-byte locale
  (e.g. GBK, Big5), byteM_parse_codeset() reads past the caller-provided
  buffer while matching the second byte range.

  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L — 5.3 (MEDIUM)

  Fixed in: libX11 1.8.14
  Fix: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/797eaf0bd
  Found by: Aisle Research (AISLE-Report-PSIRTSUPT-16718)

Fixed at 906fc285a4. Leaving open for SA.

[Bruce Dubbs]

Advisory sa-13.1-075 has been issued. This advisory covers five related Xorg libraries.