CVE-2026-109090: libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
Published Oct 27, 2026
·Updated
A malicious X server could cause a heap overflow by injecting a large DEVICEENABLE reply when processed by libXi before 1.8.4.
Affected Software
1 affected component
X.Org libXi<1.8.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libXito a version that resolves this vulnerability.Fixed in 1.8.4
Event History
Oct 27, 2026
CVE Published
via MITRE·04:32 PM
Data Sourced
via MITRE·04:32 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which clients are exposed to this issue?
Clients using X.Org libXi versions before 1.8.4 are affected when they process a DEVICE_ENABLE reply from an X server. The server can be malicious rather than the client initiating the attack locally.
2
What must an attacker do to exploit it?
An attacker needs to operate or control an X server that the target client connects to, then send a large DEVICE_ENABLE reply. Exploitation also requires user interaction, as reflected by the UI:R vector.
3
What is the remediation?
Upgrade libXi to version 1.8.4 or later. The referenced upstream commit is 4eb9f70b6.