Loading vulnerability…
Denial of Service in libXi XI2 Class Parser
CVE-2026-93543 is an out-of-bounds read vulnerability in the XI2 class parser of X.Org libXi versions before 1.8.4. Insufficient validation of server-supplied class metadata allows excessive class counts, zero or oversized class lengths, or inconsistent button and key counts to cause reads beyond the received buffer. A malicious X server can trigger the flaw through forged XI_DeviceChanged events or XIQueryDevice replies, potentially crashing a connected X client.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can terminate the affected X client, causing denial of service and interrupting application availability. No confidentiality or integrity impact, arbitrary code execution, or privilege escalation is established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, avoid connecting applications using vulnerable libXi versions to untrusted or potentially compromised X servers.
Patch, then assume compromise.
Upgrade to libXi 1.8.4 or later, or install the distribution's security update containing the backported fix. Update affected libXi runtime and related development packages as applicable. Fixed distribution releases include RHEL 8 version 1.7.10-2.el8_10 and RHEL 10 version 1.8.1-7.el10_2.1; Alpine Linux provides version 1.8.4-r0 or later. Vendor-patched packages may retain upstream version numbers below 1.8.4.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.