AZL-111166: CVE-2026-109089 affecting package libXi 1.8.1-1

Q: What systems are realistically exposed to this issue?

Systems using libXi versions before 1.8.4 are exposed when they connect to an untrusted or malicious X server. The affected package listed here is azure-linux/libxi version 1.8.1-1.

Q: What does an attacker need to exploit the flaw?

An attacker needs to operate or control a malicious X server that the vulnerable libXi client connects to. The server can send a crafted DEVICE_RESOLUTION response that triggers a heap buffer overflow.

Published Oct 27, 2026

Updated

A buffer overflow when handling DEVICERESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.

Affected Software

1 affected component

azure-linux/libxi<=1.8.1-1

Event History

Oct 27, 2026

Advisory Published

via OSV·05:16 PM

Data Sourced

via OSV·05:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-109089

Frequently Asked Questions

What systems are realistically exposed to this issue?

Systems using libXi versions before 1.8.4 are exposed when they connect to an untrusted or malicious X server. The affected package listed here is azure-linux/libxi version 1.8.1-1.

What does an attacker need to exploit the flaw?

An attacker needs to operate or control a malicious X server that the vulnerable libXi client connects to. The server can send a crafted DEVICE_RESOLUTION response that triggers a heap buffer overflow.

AZL-111166: CVE-2026-109089 affecting package libXi 1.8.1-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What systems are realistically exposed to this issue?

What does an attacker need to exploit the flaw?

Company

Resources

Contact

Frequently Asked Questions

What systems are realistically exposed to this issue?

What does an attacker need to exploit the flaw?