CVE-2026-93543: Out-of-bounds read in libXi's XI2 class parser
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.4-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
X clients that use libXi before 1.8.4 and connect to an attacker-controlled or malicious X server are exposed. The described impact is a client crash.
What does an attacker need to exploit it?
An attacker needs to operate or control the X server that an affected X client connects to. The vector is network-based, requires no privileges, and requires user interaction.
Is confidentiality or integrity impact described?
No. The supplied severity vector identifies no confidentiality or integrity impact; the stated effect is availability impact through crashing the attached X client.