CVE-2026-94281: Out-of-bounds read in libXi's XListInputDevices() class parsing
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
X clients using libXi versions before 1.8.4 are exposed when they connect to a malicious X server and invoke XListInputDevices() parsing.
What does an attacker need to exploit it?
An attacker needs to operate or control an X server that an affected X client connects to. No privileges on the client are indicated, but user interaction is required for the client to connect to the malicious server.
What is the practical impact?
A malicious X server can trigger an out-of-bounds read that crashes the attached X client. The provided impact information indicates availability impact only, with no confidentiality or integrity impact stated.
How can I remediate this issue?
Update libXi to version 1.8.4 or later. If updating is not immediately possible, avoid connecting affected clients to untrusted or attacker-controlled X servers.