CVE-2026-94282: Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion
An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.4-1 - Upgrade
Upgrade
debian/libxito a version that resolves this vulnerability.Fixed in 2:1.8.4-1 - Upgrade
Upgrade
libXito a version that resolves this vulnerability.Fixed in 1.8.4
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
X clients that use libXi before 1.8.4 and connect to an untrusted or malicious X server are exposed. The described impact is a crash of the attached X client.
What does an attacker need to exploit it?
An attacker needs to operate or control the X server to which the affected client connects. The vector is local and requires low privileges and user interaction, according to the supplied severity vector.
What version resolves the issue?
Upgrade libXi to version 1.8.4 or later. The issue affects versions before 1.8.4.