CVE-2026-93545: Out-of-bounds read in libXi's XListInputDevices()
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.4-1 - Upgrade
Upgrade
debian/libxito a version that resolves this vulnerability.Fixed in 2:1.8.4-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
X clients linked against libXi versions before 1.8.4 are exposed when they connect to a malicious X server. The reported impact is a crash of the attached client.
What does an attacker need to exploit it?
An attacker needs to operate or control an X server that the target client connects to. Exploitation also requires the client user to interact with or connect to that server.
Is this a confidentiality or integrity issue?
The available information describes an out-of-bounds read that can crash the client, resulting in an availability impact. No confidentiality or integrity impact is reported.