UBUNTU-CVE-2026-109090: High severity ubuntu/libxi vulnerability

Published Oct 27, 2026

Updated

A malicious X server could cause a heap overflow by injecting a large DEVICEENABLE reply when processed by libXi before 1.8.4.

Affected Software

7 affected components

ubuntu/libxi*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libXi to a version that resolves this vulnerability.
Fixed in 1.8.4

Event History

Oct 27, 2026

CVE Published

via OSV·05:16 PM

Data Sourced

via OSV·05:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to operate or induce use of a malicious X server that sends an oversized DEVICE_ENABLE reply. Exploitation also requires user interaction, as reflected by the UI:R vector.

Which systems are affected?

Ubuntu systems using libXi versions earlier than 1.8.4 are affected. The available data does not identify specific Ubuntu releases or package build versions.

What is the impact of successful exploitation?

Successful exploitation can cause a heap overflow in libXi while it processes the malicious reply. The vulnerability is rated high severity and has high confidentiality, integrity, and availability impact.

UBUNTU-CVE-2026-109090: High severity ubuntu/libxi vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which systems are affected?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which systems are affected?

What is the impact of successful exploitation?