USN-8913-1: four libx11 flaws patched across all Ubuntu LTS releases

Canonical published security advisory USN-8913-1 on 12 October 2026, addressing four vulnerabilities in the libx11 client-side library, used by any X11-based graphical application, including X11 forwarding via SSH commonly enabled on remote servers for debugging graphical tools.\n\n## The patched flaws\n\nThe most serious was discovered by Adam Bedard: libx11 incorrectly handled certain XKB keyboard map replies. If a user is tricked into connecting to a malicious X server, a remote attacker could exploit this flaw to crash libx11, causing denial of service, or possibly execute arbitrary code (CVE-2026-88806).\n\nThe other two relate to X Input Method messages: libx11 was found to incorrectly handle certain X Input Method (XIM) messages; if a user is tricked into connecting to a malicious X server, a remote attacker could exploit these issues to crash libx11, causing denial of service (CVE-2026-94283, CVE-2026-94284).\n\nThe fourth affects text conversion: libx11 incorrectly handled conversion of certain multibyte text. An attacker could exploit this issue to crash libx11, causing denial of service (CVE-2026-94285).\n\n## Fixed versions and instructions\n\nThe issue can be resolved by updating your system to the following package versions:\n\n| Ubuntu Release | libx11-6 Version |\n|---|---|\n| 26.04 LTS (resolute) | 2:1.8.13-1ubuntu0.1 |\n| 24.04 LTS (noble) | 2:1.8.7-1ubuntu0.1 |\n| 22.04 LTS (jammy) | 2:1.7.5-1ubuntu0.4 |\n| 20.04 LTS (focal) | 2:1.6.9-2ubuntu1.6+esm1 (Ubuntu Pro) |\n| 18.04 LTS (bionic) | 2:1.6.4-3ubuntu0.4+esm3 (Ubuntu Pro) |\n| 16.04 LTS (xenial) | 2:1.6.3-1ubuntu2.2+esm5 (Ubuntu Pro + Legacy Support) |\n| 14.04 LTS (trusty) | 2:1.6.2-1ubuntu2.1+esm6 (Ubuntu Pro + Legacy Support) |\n\nFor 20.04, 18.04, 16.04 and 14.04, the fix is distributed only via Ubuntu Pro. For other releases, a standard package update is sufficient.\n\nCanonical notes that after a standard system update, a system reboot is required to ensure all necessary changes take effect. Those running X11 forwarding on development servers or remote workstations should plan the update and reboot shortly, given the code execution risk reported for CVE-2026-88806.