Out-of-Bounds Read in X11 RECORD Protocol Parser

CVE-2026-94286 is an out-of-bounds read vulnerability in libXtst's RECORD reply parser affecting versions before 1.2.6. The vulnerability allows a malicious X server to crash X clients that connect to it by sending specially crafted RECORD protocol replies that trigger memory reads beyond allocated buffer boundaries. This matters because X11 is fundamental to Unix/Linux graphical environments—any compromise of core X libraries affects all client applications relying on them. System administrators, Linux desktop users, remote desktop users, and developers using libXtst are at risk. The CVSS score of 7.1 indicates high severity due to denial-of-service impact, though active exploitation in the wild has not been documented.

While this CVE does not directly map to MITRE ATT&CK techniques, Casky's security practitioners would detect the attack patterns through vulnerability assessment and protocol analysis capabilities. A practitioner using Casky's Claude-powered extended reasoning would identify this as a protocol-level denial-of-service vector—malicious X servers sending out-of-bounds triggering inputs. Findings would flag: (1) applications linked against vulnerable libXtst versions, (2) X11 protocol monitoring for malformed RECORD replies, and (3) process crash patterns correlating with X server connections. By mapping this to CWE-126 (buffer over-read) and analyzing client-server protocol interactions, security teams would see recommendations to upgrade libXtst to 1.2.6+, restrict X server connectivity to trusted sources, and monitor for unexpected X client terminations that could indicate exploitation attempts.