Skip to content
OpenAdvisories
High ALAS2023-2026-3394 9 CVEs

Important: libXi security update (Amazon Linux 2023)

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-94282: Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion. CVE-2026-94281: An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. CVE-2026-93545: An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. CVE-2026-93544: An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client. CVE-2026-93543: An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. CVE-2026-93542: An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client. CVE-2026-93541: A flaw was found in libXi. An out-of-bounds read vulnerability in the XQueryDeviceState() function allows a malicious X server to trigger an application crash. By returning a specially crafted response to a device state query, the server causes the client application to read memory beyond allocated buffer boundaries, resulting in a Denial of Service (DoS). CVE-2026-109090: libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html NOTE: https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/26 NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b67034ace1abdf785fd8dcba7b6dc739d CVE-2026-109089: libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2023 libXi 0:1.8.4-1.amzn2023.0.1
Amazon Linux · 2023 libXi-debuginfo 0:1.8.4-1.amzn2023.0.1
Amazon Linux · 2023 libXi-debugsource 0:1.8.4-1.amzn2023.0.1
Amazon Linux · 2023 libXi-devel 0:1.8.4-1.amzn2023.0.1

Vulnerabilities 9

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109089.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109090.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-93541.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-93542.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-93543.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-93544.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-93545.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-94281.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-94282.html