CVE-2026-93541: Out-of-bounds read in libXi's XQueryDeviceState()
Published Sep 24, 2026
·Updated
An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a
Affected Software
6 affected componentsFixes available
X.Org libXi<1.8.4
Microsoft azl3 libXi 1.8.1-1<1.8.4-1
1.8.4-1
debian/libxi*
debian/libxi*
debian/libxi<2:1.8.4-1
2:1.8.4-1
debian/libxi<=2:1.8-1, <=2:1.8.2-1
2:1.8.4-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.4-1 - Upgrade
Upgrade
debian/libxito a version that resolves this vulnerability.Fixed in 2:1.8.4-1
Event History
Sep 24, 2026
CVE Published
via MITRE·03:58 PM
Data Sourced
via MITRE·03:58 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Sep 28, 2026
Data Sourced
via Microsoft·10:25 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·10:25 AM
Affected Software
Nov 2, 2026
Data Sourced
via OSV·12:00 PM
Affected Software
Frequently Asked Questions
1
Which libXi versions require remediation?
libXi versions before 1.8.4 are affected. Upgrade to 1.8.4 or later.
2
What conditions are indicated for exploitation?
The CVSS vector indicates network access, low attack complexity, no required privileges, and required user interaction. The stated impact is high availability impact, with no confidentiality or integrity impact.