DEBIAN-CVE-2026-109090: High severity debian/libxi vulnerability

Published Oct 27, 2026

Updated

A malicious X server could cause a heap overflow by injecting a large DEVICEENABLE reply when processed by libXi before 1.8.4.

Affected Software

3 affected components

debian/libxi*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libXi to a version that resolves this vulnerability.
Fixed in 1.8.4

Event History

Oct 27, 2026

CVE Published

via OSV·05:16 PM

Data Sourced

via OSV·05:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using libXi before 1.8.4 that connect to an untrusted or malicious X server are exposed. Exploitation requires the victim to interact with that X server.

What must an attacker do to exploit the vulnerability?

The attacker must operate or control an X server and send an oversized DEVICE_ENABLE reply for libXi to process. The issue is remotely reachable, but exploitation has high attack complexity and requires user interaction.

What can be done if upgrading libXi is not immediately possible?

Avoid connecting affected applications to untrusted X servers. Limit X server connections to trusted local or controlled servers until libXi can be updated to 1.8.4 or later.