Loading vulnerability…
Out-of-bounds read in libXi XQueryDeviceState()
CVE-2026-93541 is an out-of-bounds read vulnerability in X.Org libXi versions before 1.8.4. XQueryDeviceState() trusts the num_valuators field in a server-supplied ValuatorClass reply without checking that the valuator data fits within the declared class length. A malicious or compromised X server can supply a forged reply that causes an affected client application to read beyond the reply buffer and potentially crash.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash an application using the affected libXi function, causing denial of service. Memory disclosure has been identified as a potential consequence, but is not established by the detailed vulnerability information. Code execution and integrity impact are not established.
If you can’t patch tonight, do this now.
Until patched, avoid connecting affected applications to untrusted X servers and avoid invoking XQueryDeviceState() where operationally feasible. Separate privileged application logic from graphical interfaces to reduce exposure of privileged processes. These measures do not correct the underlying bounds-checking flaw.
Patch, then assume compromise.
Upgrade libXi to version 1.8.4 or later, or install the distribution's security update containing the backported fix. Identified fixed package versions include Alpine Linux libxi 1.8.4-r0 and Echo libxi 2:1.8.2-1+e1. When backporting fixes, consider the additional libXi 1.8.4 hardening changes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.