This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-94285 →

UBUNTU-CVE-2026-94285

An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X client...

Original description

The description as published by the source.

An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:Pro:14.04:LTS libx11

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.6.2-1ubuntu2.1+esm6"}]}]

Ubuntu:Pro:16.04:LTS libx11

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.6.3-1ubuntu2.2+esm5"}]}]

Ubuntu:Pro:18.04:LTS libx11

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.6.4-3ubuntu0.4+esm3"}]}]

Ubuntu:Pro:20.04:LTS libx11

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.6.9-2ubuntu1.6+esm1"}]}]

Ubuntu:22.04:LTS libx11

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.7.5-1ubuntu0.4"}]}]

Ubuntu:24.04:LTS libx11

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.8.7-1ubuntu0.1"}]}]

Ubuntu:26.10 libx11

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.04:LTS libx11

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.8.13-1ubuntu0.1"}]}]

Original description

Affected packages

References