SUSE-SU-2026:5166-1: Security update for libXi

Q: Which vulnerability in this update involves a heap buffer overflow rather than an out-of-bounds read?

CVE-2026-109089 is a heap buffer overflow caused by an XGetDeviceControl control-type mismatch, and CVE-2026-109090 is a heap buffer overflow involving DEVICE_ENABLE handling in XGetDeviceControl. The other listed issues are described as out-of-bounds reads.

Q: Which libXi interfaces are implicated by the reported issues?

The affected interfaces include XQueryDeviceState(), XListInputDevices(), XGetDeviceControl(), XIQueryDevice reply parsing, XI2 class parsing, and XI2 enter, leave, and focus cookie conversion.

Published Nov 10, 2026

Updated

This update for libXi fixes the following issues:

- CVE-2026-93541: Out-of-bounds read in libXi's XQueryDeviceState() (bsc#1281605). - CVE-2026-93542: Out-of-bounds read in libXi's XI2 class parsing via sizeclasses() and copyclasses() (bsc#1281606). - CVE-2026-93543: Out-of-bounds read in libXi's XI2 class parser (bsc#1281608). - CVE-2026-93544: Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing (bsc#1281609). - CVE-2026-93545: Out-of-bounds read in libXi's XListInputDevices() (bsc#1281612). - CVE-2026-94281: Out-of-bounds read in libXi's XListInputDevices() class parsing (bsc#1281615). - CVE-2026-94282: Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversio (bsc#1281651). - CVE-2026-109089: XGetDeviceControl Control Type Mismatch Heap Buffer Overflow (bsc#1285084). - CVE-2026-109090: XGetDeviceControl DEVICEENABLE Heap Buffer Overflow (bsc#1285085).

Affected Software

2 affected componentsFixes available

suse/libxi<1.7.4-18.11.1

1.7.4-18.11.1

suse/libxi<1.7.4-18.11.1

1.7.4-18.11.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/libXi to a version that resolves this vulnerability.
Fixed in 1.7.4-18.11.1

Event History

Nov 10, 2026

Advisory Published

via OSV·02:04 PM

Data Sourced

via OSV·02:04 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which vulnerability in this update involves a heap buffer overflow rather than an out-of-bounds read?

CVE-2026-109089 is a heap buffer overflow caused by an XGetDeviceControl control-type mismatch, and CVE-2026-109090 is a heap buffer overflow involving DEVICE_ENABLE handling in XGetDeviceControl. The other listed issues are described as out-of-bounds reads.

Which libXi interfaces are implicated by the reported issues?

The affected interfaces include XQueryDeviceState(), XListInputDevices(), XGetDeviceControl(), XIQueryDevice reply parsing, XI2 class parsing, and XI2 enter, leave, and focus cookie conversion.

SUSE-SU-2026:5166-1: Security update for libXi

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which vulnerability in this update involves a heap buffer overflow rather than an out-of-bounds read?

Which libXi interfaces are implicated by the reported issues?

Company

Resources

Contact

Frequently Asked Questions

Which vulnerability in this update involves a heap buffer overflow rather than an out-of-bounds read?

Which libXi interfaces are implicated by the reported issues?