Loading vulnerability…
Out-of-bounds read in libXi XListInputDevices() class parsing
CVE-2026-94281 is an out-of-bounds read vulnerability in the XListInputDevices() class parsing logic of libXi versions before 1.8.4. SizeClassInfo() checks individual class-record lengths against the original buffer size without decrementing the remaining size as parsing advances. Consequently, individually acceptable class lengths can cumulatively advance beyond the received reply buffer. ParseClassInfo() also lacks bounds checking. A malicious X server can supply a crafted ListInputDevices reply that triggers an out-of-bounds read and crashes the connected X client.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can terminate the affected X client application, causing denial of service. Confidentiality loss, integrity compromise, and arbitrary code execution are not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, avoid connecting X clients to untrusted or attacker-controlled X servers. Separate privileged functionality from graphical interfaces to reduce the consequences of vulnerabilities in X client libraries; this architectural measure does not prevent the client crash.
Patch, then assume compromise.
Upgrade libXi to version 1.8.4 or later, or install a distribution package containing the backported fix. Identified fixed distribution packages include Alpine libxi 1.8.4-r0 or later and Echo libxi 2:1.8.2-1+e1 or later. When backporting fixes, consider the additional libXi hardening changes included in version 1.8.4.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.