A heap buffer overflow occurs in libXi before version 1.8.4 when the library processes a DEVICE_RESOLUTION control type. The mismatch between the expected control format and the supplied data corrupts heap memory, creating an opportunity for attackers to execute arbitrary code. The flaw is a classic buffer overflow identified as CWE-122 and could compromise confidentiality, integrity, and availability of the system if exploited.

The vulnerability affects the X.Org libXi library in all releases older than 1.8.4. Any system that uses a pre-1.8.4 version of libXi, regardless of operating system, is susceptible, since the flaw is located in the library itself.

The CVSS score of 7.5 indicates high severity. EPSS data is not available, but based on the details, the overflow can be triggered remotely by a malicious X server, indicating a remote execution vector. The exploitation would require an attacker to send a specially crafted DEVICE_RESOLUTION request via the X protocol to a vulnerable server. Although the vulnerability is not listed in CISA’s KEV catalog, the remote nature of the attack vector and the high severity score warrant close monitoring.