CVE-2026-109090High· 7.5▾ TwilightA malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
libXi < 1.8.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109089High· 7.5libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow
CVE-2026-94282Medium· 5.6An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.
CVE-2026-93542Medium· 6.5An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client.
CVE-2026-93543High· 7.4An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
CVE-2026-93544Medium· 6.5An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.
CVE-2026-93545Medium· 6.5An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.