RLSA-2026:93438: Important: libXi security update
X.Org X11 libXi runtime library
Security Fix(es):
libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply (CVE-2026-109090)
libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow (CVE-2026-109089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/libXito a version that resolves this vulnerability.Fixed in 0:1.7.10-4.el8_10
Event History
Frequently Asked Questions
What would an attacker need to exploit these issues?
The supplied CVSS vector indicates that exploitation is network-accessible, requires high attack complexity, needs no privileges, and requires user interaction. Successful exploitation can lead to arbitrary code execution.
What is the potential impact if exploitation succeeds?
Both listed flaws are described as arbitrary code execution vulnerabilities. The CVSS vector indicates high impact to confidentiality, integrity, and availability.
How can I determine whether this advisory applies to a system?
Check whether the system uses the Rocky Linux libXi runtime library. The advisory identifies two affected libXi issues: an oversized DEVICE_ENABLE reply flaw and a DEVICE_RESOLUTION heap-based buffer overflow.