A malicious X server may send malformed RECORD EnableContext replies that cause an X client using the parse_reply_call_callback function in libXtst before version 1.2.6 to enter an endless loop. This loop consumes CPU cycles and prevents the client from recovering, leading to a denial of service for the affected application and potentially the entire desktop environment.

The vulnerability affects the X.org libXtst library in all releases prior to 1.2.6. Any X client on systems running these versions that rely on the library’s RECORD extension handling is susceptible, including common desktop applications that process X events.

The CVSS score of 6.5 indicates moderate severity. Because the exploitation requires a malicious X server to send crafted replies, an attacker needs access to either a compromised X server or the ability to supply an attacker-controlled server to the vulnerable client. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread, automated exploitation. Nonetheless, the infinite loop can lead to a noticeable denial of service and should be addressed promptly.