Loading vulnerability…
Out-of-bounds read in libXi XListInputDevices()
CVE-2026-93545 is an out-of-bounds read vulnerability in XListInputDevices() in libXi versions before 1.8.4. When parsing device-name strings in a ListInputDevices reply, the function fails to adequately validate a server-supplied name-length byte against the remaining reply bytes. A malicious X server can supply an excessive length, causing memcpy() to read beyond the reply buffer and potentially crash the connected X client.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can terminate the affected X client, causing application-level denial of service. Confidentiality loss, integrity compromise, and arbitrary code execution are not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, avoid connecting X clients to untrusted X servers and restrict connections to trusted servers. Separating privileged functionality from graphical interfaces can reduce the broader risks associated with X client-library vulnerabilities but does not correct the out-of-bounds read.
Patch, then assume compromise.
Upgrade libXi to version 1.8.4 or later, or install a distribution-supported package containing the backported fix. Distribution-specific fixed packages include Alpine libxi 1.8.4-r0 or later and Echo libxi 2:1.8.2-1+e1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.