Ubuntu patches libXtst: DoS flaw in X11 RECORD extension

Canonical released security advisory USN-8939-1 on 19 October 2026, addressing several vulnerabilities in the libXtst library across all currently supported Ubuntu releases, from 16.04 LTS through 26.10. For system administrators running Ubuntu servers with X11 packages installed — which happens more often than you'd expect, via dependencies of automation tools, X11 forwarding over SSH, or remote access software — this is an update worth not skipping, even though the practical risk remains modest.\n\n## What libXtst does and why it matters\n\nThe package provides the X Window System client interface to the Record extension of the X protocol. The Record extension allows X clients to synthesise input events, which is useful for automated testing. It's not a library you'd expect on a pure headless server, but it shows up as a dependency in environments with GUI automation, testing frameworks, or software such as x11vnc.\n\n## The vulnerabilities addressed\n\nThe advisory covers three issues. The most recent, CVE-2026-94286, affects all releases: a malicious X server can exploit improper handling of RECORD responses to crash libXtst clients, resulting in denial of service. The other two, CVE-2016-7951 and CVE-2016-7952, discovered by Tobias Stoeckmann, affect Ubuntu 16.04 LTS only: the first causes out-of-bounds memory access, the second an infinite loop, both triggered by a compromised X server.\n\n## Corrected versions and how to update\n\n| Release | Package | Corrected version |\n|---|---|---|\n| 26.10 (stonking) | libxtst6 / libxtst-dev | 2:1.2.5-1ubuntu1 |\n| 26.04 LTS (resolute) | libxtst6 / libxtst-dev | 2:1.2.5-1ubuntu0.1 |\n| 24.04 LTS (noble) | libxtst6 / libxtst-dev | 2:1.2.3-1.1ubuntu0.1 |\n| 22.04 LTS (jammy) | libxtst6 / libxtst-dev | 2:1.2.3-1ubuntu0.22.04.1 |\n| 20.04 LTS (focal) | libxtst6 / libxtst-dev | 2:1.2.3-1ubuntu0.20.04.1esm1 (requires Ubuntu Pro) |\n| 18.04 LTS (bionic) | libxtst6 / libxtst-dev | 2:1.2.3-1ubuntu0.18.04.1esm1 (requires Ubuntu Pro) |\n| 16.04 LTS (xenial) | libxtst6 / libxtst-dev | 2:1.2.2-1ubuntu0.1~esm1 (requires Ubuntu Pro with Legacy Support add-on) |\n\nOn releases no longer under standard support (20.04, 18.04, 16.04) the patch arrives only through Ubuntu Pro. Canonical notes that the programme covers over 25,000 packages from the Main and Universe repositories with ten years of security updates and is free for up to five machines—an option worth considering if you still have instances on older versions and cannot migrate immediately. On all other releases, the usual apt update && apt upgrade will suffice."