Summary
X.Org X11 libXi runtime library
Security Fix(es):
* libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser (CVE-2026-93543)
* libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090)
* libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | libXi | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi-debuginfo | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi-debuginfo | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi-debuginfo | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi-debuginfo | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi-debugsource | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi-debugsource | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi-debugsource | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi-debugsource | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi-devel | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi-devel | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi-devel | 0:1.8.1-7.el10_2.3 |
| Rocky Linux · 10 | libXi-devel | 0:1.8.1-7.el10_2.3 |
Vulnerabilities 3
-
High 7.5
libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow
A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.
-
High 7.5
libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
-
High 7.4
Out-of-bounds read in libXi's XI2 class parser
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.