CVE-2026-88806

Severity: Important

Published: 2026-09-21

A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.

Exploit evidence

No public exploit evidence reported by NVD

Last checked: 2026-09-22 21:40 UTC

No exploitation evidence · CISA Coordinator (Assessed 2026-09-21 00:00 UTC)

NVD evidence for CVE-2026-88806 is reported, not independently verified by Package Alert. It does not establish exploit reliability or applicability to a particular package or environment.

References

Fix Status by Distribution

Fix evidence last checked: 2026-10-13 07:36 UTC

Fixed in:

SUSE Linux Enterprise Server 12 SP5
- SUSE-SU-2026:4410 · Published 2026-10-01
SUSE Linux Enterprise Server 15 SP5
- SUSE-SU-2026:4500 · Published 2026-10-05
SUSE Linux Enterprise Server 15 SP6
- SUSE-SU-2026:4501 · Published 2026-10-05
SUSE Linux Enterprise Server 15 SP7
- SUSE-SU-2026:4502 · Published 2026-10-05
SUSE Linux Enterprise Server 16
- SUSE-SU-2026:23899 · Published 2026-09-22
Ubuntu 22.04 LTS (Jammy Jellyfish)
- USN-8913-1 · Published 2026-10-12
Ubuntu 24.04 LTS (Noble Numbat)
- USN-8913-1 · Published 2026-10-12
Ubuntu 26.04 LTS (Resolute Raccoon)
- USN-8913-1 · Published 2026-10-12

No fix evidence found:

AlmaLinux 10

AlmaLinux 8

AlmaLinux 9

Debian 11 (Bullseye)

Debian 12 (Bookworm)

Debian 13 (Trixie)

Oracle Linux 10

Oracle Linux 8

Oracle Linux 9

Red Hat Enterprise Linux 10

Red Hat Enterprise Linux 7 (Extended Lifecycle Support)

Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 9

Rocky Linux 10

Rocky Linux 8

Rocky Linux 9

Ubuntu 25.04 (Plucky Puffin)

Ubuntu 25.10 (Questing Quokka)

Ubuntu 26.10 (Stonking Stingray)

Interested in being alerted when these distributions have fixes? Set up an alert.