X.org Libxtst vulnerabilities

2 CVEs affecting X.org Libxtst, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-94286, published 2026-09-28.

More from X.org.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-7952, published 2016-12-13. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, (2) XRecordEndOfData, or (3) XRecordClientDied category…
• CVE-2026-94286, published 2026-09-28. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.