Loading vulnerability…
Out-of-bounds read in libXi XI2 event-cookie conversion
CVE-2026-94282 is an out-of-bounds read vulnerability in the XI2 enter/leave/focus event-cookie conversion code in libXi versions before 1.8.4. The wireToEnterLeave() function insufficiently validates the server-supplied buttons_len against the received event length. A malicious X server can send a crafted XI2 Enter, Leave, FocusIn, or FocusOut GenericEvent with a small outer length and an oversized buttons_len, causing data to be copied from beyond the received event buffer and potentially crashing the connected X client.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash an affected X client, causing application-level denial of service. Limited confidentiality impact from out-of-bounds memory access is also identified, although a concrete mechanism for disclosing that memory to the attacker is not established. Arbitrary code execution or integrity compromise is not demonstrated.
If you can’t patch tonight, do this now.
Until patched, avoid connecting affected X clients to untrusted or potentially compromised X servers. Separate privileged operations from graphical user interfaces to reduce the consequences of X client vulnerabilities. No vulnerability-specific workaround is identified.
Patch, then assume compromise.
Upgrade to libXi 1.8.4 or later, or install the operating-system vendor's security update containing the backported fix. Distribution-specific fixed versions include Alpine libxi 1.8.4-r0 and Echo libxi 2:1.8.2-1+e1. When backporting fixes, consider the additional security-hardening changes included in libXi 1.8.4.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.