Hi,

The following vulnerability was published for libxtst.

CVE-2026-94286[0]:
| An out-of-bounds read in libXtst's RECORD reply parser in libXtst
| before 1.2.6 could be used by malicious X servers to crash attached
| X clients.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-94286
https://www.cve.org/CVERecord?id=CVE-2026-94286
[1] https://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/10

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libxtst, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149667@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emilio Pozuelo Monfort <pochu@debian.org> (supplier of updated libxtst package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 26 Oct 2026 20:02:43 +0100
Source: libxtst
Architecture: source
Version: 2:1.2.6-1
Distribution: unstable
Urgency: medium
Maintainer: Debian X Strike Force <debian-x@lists.debian.org>
Changed-By: Emilio Pozuelo Monfort <pochu@debian.org>
Closes: 1149667
Changes:
 libxtst (2:1.2.6-1) unstable; urgency=medium
 .
   * New upstream release (closes: #1149667).
     - CVE-2026-94286: Out-of-bounds read in libXtst's RECORD reply parser.
     - CVE-2026-109088: libXtst RECORD EnableContext Reply Endless Loop
   * Update signing-key.asc.
Checksums-Sha1:
 7df8ee0d3d7c2f2f9cb41e4200fbd66148c205e6 2089 libxtst_1.2.6-1.dsc
 c2a712d96329729650e949afad6c7d64d6edbd8a 456527 libxtst_1.2.6.orig.tar.gz
 e37abd78426b3de33016859950155934eb01d6e6 21594 libxtst_1.2.6-1.diff.gz
 b69e2bbcf8a0b5d9cea2154eb16519def43df6a2 6562 libxtst_1.2.6-1_source.buildinfo
Checksums-Sha256:
 b64d8bf301c32091c8a34ef2d8c6c42b133948d892efa66567d66003ca6da807 2089 libxtst_1.2.6-1.dsc
 f30f2d4f8370077de9f35220a539bf34c042ca02a55669a4d8f345c661ce7839 456527 libxtst_1.2.6.orig.tar.gz
 e9e503da30bb53c5f533e697a6bbfed2d0e9f2226f503e37e21ffdb5de099f99 21594 libxtst_1.2.6-1.diff.gz
 38e026f4f0f0c49de98d46894d4da1e0bf2c360209e8058bc65e36424c2173f6 6562 libxtst_1.2.6-1_source.buildinfo
Files:
 be1b788472132d252d76ea28cbab41a0 2089 x11 optional libxtst_1.2.6-1.dsc
 6ab476312db67adb2343d807932699ba 456527 x11 optional libxtst_1.2.6.orig.tar.gz
 761d3b9adfb8e7de6bb36f492a4493d6 21594 x11 optional libxtst_1.2.6-1.diff.gz
 4acb0348fd9f148bfae60f20c35407f2 6562 x11 optional libxtst_1.2.6-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAmrgUpEACgkQnUbEiOQ2
gwI1jhAAq6DZoK1XvYtMyTKdxfkuCfBF1wYUTUcrf8KUD5XXLPho0MGZiqs9GSsc
wiLbFPW1paU5aRQfYddUrRzUiohxDtDneT/Vtd/x3mfe2gWL7rr6QCwYpZjdlaiz
X6tcXyVLCp9aV0QmthSjSAvd0t0PuKgOjQzQqkMwdwzRBuKnLUCDR8nT7Z1uC7u1
0P+Dklcwe9srjs88YbiZo7U8rIyY+aE8Ebc/w4MdZM/y4fT/T2WoD1TINgszeuep
YjJRPkGglFi/dHXGI2GPTionpqUGXf2Bdsww1KXAGB9ZN+uI9XtXaL6hEqXPJJ89
GGLmdu05cp7JE8g9uFXLcZzUhTvhlwrplOLmbNPvy31Ma8bzwFLuNrZ//eT51dXX
wBVoVcn1hyClnmTM5TaUy6abOKa4t8pFcSylfFxiNBZ8xxRNywooHME5NxluoUmg
63x0sVETZVfScns0AgAb7g9+aBhQei59oUYArqswd2kKhR+Gj5vjEEJ394mLDfS+
UMPzd4YC8okCZjcyY/G0uPZYBMbaaqO0Jkd8MkSdHhf4l6PchyNYg/3Hd20GHJOO
Keh8D2ogT9OSeW8mmiZF59bf1cR+wFRgMnbQLvRM2xXw+K1qqq99pg8dKBcaJlwJ
KwSnPzUkXBqLEn7bdgCG7SePwZlUOob64YwqncV7/8IWi25d6bY=
=JnfD
-----END PGP SIGNATURE-----