CVE-2026-94284

mediumpriority · track · 0EPSS 0.001 · 3 %ileDEFR

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.13% (3rd) EPSS

CVSS 5.5 · medium

Is it mine?

5 products

Check your exposure

Who says so?

2 sources

cert_bund · certfr

EPSS · scored 2026-10-27

An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.

cvss

Technical severity, 0–10. One row per scoring source.

5.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:Hsecondary · meissner@suse.deexploitability 1.8 · impact 3.6

v3.15.1mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-125US

affected products (5)

Products and version ranges known to be affected.

Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Open Source X.Org X11< 1.8.14cert_bundDE

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3606X.Org X11: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2026-09-27csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in X.Org X11 ausnutzen, um einen Denial of Service Angriff durchzuführen.
CERTFR-2026-AVI-1333Multiples vulnérabilités dans le noyau Linux d'UbuntuFrançais2026-10-16vendor · certfrFR

sources

Which sources assert this record, and when.

cert_bund certfr NVD CVE.org MITRE

published 2026-09-28modified 2026-09-30

references (1) nvd

External citations — patches, advisories, analysis.

https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=1b7904002d212eed40949ccf4e8e7156f9fec0e2

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan