CVE-2026-93542: Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes()
An out-of-bounds read in libXi's XI2 class parsing via sizeclasses() and copyclasses() in libXi before 1.8.4 could be used by malicous servers to crash the X client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.4-1 - Upgrade
Upgrade
debian/libxito a version that resolves this vulnerability.Fixed in 2:1.8.4-1
Event History
Frequently Asked Questions
Which clients are exposed to this issue?
X clients that use libXi versions before 1.8.4 and connect to a malicious X server are exposed. The reported impact is a client crash.
What does an attacker need to exploit it?
An attacker needs to operate or control an X server that the target X client connects to. Exploitation requires user interaction because the client must connect to that malicious server.
Does the vulnerability affect confidentiality or integrity?
The supplied severity vector indicates no confidentiality or integrity impact. The impact is limited to availability through a crash of the X client.