RLSA-2026:98504: Important: libXi security update
X.Org X11 libXi runtime library
Security Fix(es):
libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser (CVE-2026-93543)
libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply (CVE-2026-109090)
libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow (CVE-2026-109089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/libXito a version that resolves this vulnerability.Fixed in 0:1.7.10-8.el9_8.3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What access would an attacker need to exploit these issues?
The advisory's CVSS vector indicates network attack access, no privileges required, and user interaction required. It does not specify the exact interaction or attack workflow.
What could successful exploitation allow?
The listed issues include denial of service through an out-of-bounds read and arbitrary code execution through an oversized DEVICE_ENABLE reply or a DEVICE_RESOLUTION heap-based buffer overflow. The CVSS vector indicates high impact to confidentiality, integrity, and availability.
Which Rocky Linux component should be prioritized for remediation?
Systems using the Rocky Linux libXi runtime library should be prioritized. The advisory does not provide affected or fixed package versions, so version-level exposure cannot be determined from this information.