Summary
[1.7.10-8.3]
- CVE-2026-109089 libXi: libXi: Arbitrary code execution via
DEVICE_RESOLUTION heap-based buffer overflow
Resolves: RHEL-293452
[1.7.10-8.2]
- CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply
Resolves: RHEL-293398
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | libXi | 0:1.7.10-8.el9_8.3 |
| Oracle Linux · 9 | libXi-devel | 0:1.7.10-8.el9_8.3 |
Vulnerabilities 2
-
High 7.5
libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow
A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.
-
High 7.5
libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.