Loading vulnerability…
Out-of-bounds read in libXi XIQueryDevice reply parsing
CVE-2026-93544 is an out-of-bounds read vulnerability in XI2 XIQueryDevice reply parsing in libXi before version 1.8.4. The size_classes() and copy_classes() helpers and their XIQueryDevice() caller traverse server-supplied wire data using length, num_buttons, and num_keycodes values without sufficient bounds checking. A malicious X server can supply a malformed reply that causes reads beyond the received buffer and crashes an attached X client.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can terminate an affected X client application, causing denial of service. No confidentiality or integrity impact is established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, avoid connecting affected X clients to untrusted X servers. Restrict display connections to trusted local or authenticated servers; authentication alone does not protect against a compromised server. Separate privileged functionality from graphical interfaces to reduce the consequences of X client vulnerabilities.
Patch, then assume compromise.
Upgrade libXi to version 1.8.4 or later, or install the distribution's security-fixed package. Fixed distribution packages include Alpine libxi 1.8.4-r0 and Echo libxi 2:1.8.2-1+e1. When backporting fixes, consider the additional libXi hardening included in release 1.8.4.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.