AZL-111169: CVE-2026-109090 affecting package libXi 1.8.1-1

Q: Which systems are exposed to this issue?

Systems using libXi versions before 1.8.4 are exposed when they connect to or process replies from a malicious X server. The affected Azure Linux package is identified as libXi 1.8.1-1.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to operate or control an X server that the affected libXi client communicates with. The server must send an oversized DEVICE_ENABLE reply for libXi to process.

Published Oct 27, 2026

Updated

A malicious X server could cause a heap overflow by injecting a large DEVICEENABLE reply when processed by libXi before 1.8.4.

Affected Software

1 affected component

azure-linux/libxi<=1.8.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libXi to a version that resolves this vulnerability.
Fixed in 1.8.4

Event History

Oct 27, 2026

Advisory Published

via OSV·05:16 PM

Data Sourced

via OSV·05:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-109090

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using libXi versions before 1.8.4 are exposed when they connect to or process replies from a malicious X server. The affected Azure Linux package is identified as libXi 1.8.1-1.

What does an attacker need to exploit the vulnerability?

An attacker needs to operate or control an X server that the affected libXi client communicates with. The server must send an oversized DEVICE_ENABLE reply for libXi to process.

AZL-111169: CVE-2026-109090 affecting package libXi 1.8.1-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit the vulnerability?