Loading vulnerability…
Out-of-bounds read in libXi XI2 class parsing
CVE-2026-93542 is an out-of-bounds read vulnerability in the XI2 class parser in libXi versions before 1.8.4. The size_classes() and copy_classes() helpers insufficiently validate class lengths in XIQueryDevice replies and XI_DeviceChanged events. A malicious or compromised X server can supply inconsistent class lengths that cause parsing beyond the received buffer, potentially crashing the connected X client.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash an affected X client application, causing denial of service. The vulnerability has a high availability impact; confidentiality loss, integrity compromise, and arbitrary code execution are not established.
If you can’t patch tonight, do this now.
Until patched, avoid connecting affected X clients to untrusted or potentially compromised X servers. Separate privileged application code from graphical interfaces to reduce the broader risks associated with unsafe X client library parsing; this does not correct the vulnerability.
Patch, then assume compromise.
Upgrade libXi to version 1.8.4 or later, or install a distribution-supported package containing the backported fix. Fixed distribution releases include Oracle Linux 8 package release 1.7.10-2, Oracle Linux 10 package release 1.8.1-7.1, Alpine Linux 1.8.4-r0, and Echo 2:1.8.2-1+e1. Update associated libXi development packages where applicable. Maintainers backporting individual patches should also consider the additional hardening included in libXi 1.8.4.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.