libXtst-1.2.6 (Xorg library)

[Bruce Dubbs]

New point version.

[Joe Locash]

libXtst provides the Xlib-based client API for the XTEST & RECORD extensions.

This release provides fixes for CVE-2026-94286 & CVE-2026-109088.

See the advisory for more information:
https://lists.x.org/archives/xorg-announce/2026-October/003752.html

Alan Coopersmith (2):
      gitlab CI: drop the ci-fairy check-mr job
      libXtst 1.2.6

Olivier Fourdan (2):
      parse_reply_call_callback: check element size against remaining reply buffer
      parse_reply_call_callback: reject zero-progress RECORD reply elements

git tag: libXtst-1.2.6

From ​https://lists.x.org/archives/xorg-announce/2026-October/003752.html

========================================================================
libXtst - 2 CVEs
========================================================================

* CVE-2026-94286:
  Out-of-bounds read in libXtst's RECORD reply parser.

  A malicious Xserver can send a crafted RECORD reply where the inner
  element's datum_bytes exceeds the actual reply buffer size, causing
  the RECORD callback to receive a pointer/length pair that extends past
  the allocated buffer.
  When the callback reads the advertised payload, it triggers an out of
  bounds read that can crash the client or expose adjacent process memory.

  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H — 7.1 (HIGH)

  Fixed in: libXtst 1.2.6
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/b84737d84
  Found by: Aisle Research (AISLE-Report-PSIRTSUPT-16762)

* CVE-2026-109088:
  libXtst RECORD EnableContext Reply Endless Loop

  parse_reply_call_callback() advances through RECORD EnableContext
  reply elements by datum_bytes. A zero-sized XRecordFromClient
  (BIG-REQUESTS length 0) or an undefined category byte leaves
  datum_bytes at 0 while bytes remain, so the loop never terminates
  and the application callback is invoked forever with empty data.

  A malicious or compromised X server answering EnableContext can hang
  XRecordEnableContext() (sync) or livelock Xlib reply processing
  (async).

  Fixed in: libXtst 1.2.6
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/ac60f5f47
  Found by: Kaya Emre Arikan.

Fixed at e80d0253ab. Leaving open for SA.

[Bruce Dubbs]

Advisory sa-13.1-075 has been issued. This advisory covers five related Xorg libraries.