An out‑of‑bounds read in libXtst’s RECORD reply parser can be triggered by a malicious X server and causes the attached X client to crash. The vulnerability does not enable code execution or data disclosure, but the crash can lead to service disruption for the affected user or application.

The flaw affects the x.org:libXtst implementation of the LinuxX.Org protocol library, in any release prior to version 1.2.6. Systems running older libXtst packages on any platform that relies on the X server protocol are therefore vulnerable.

The vulnerability scores a CVSS of 7.1, indicating medium‑to‑high impact. No EPSS information is available, and the CVE is not listed in CISA’s KEV catalog, suggesting no widely‑publicized exploitation to date. The attack vector is inferred to be remote, since a rogue X server can send a crafted RECORD reply to a victim’s X client, which is typically an application with elevated privileges. Exploitation would require network access to the client’s X server port or local to the machine running the X client. Given the severity score, the risk to systems exposed to untrusted X servers is significant.