An out‑of‑bounds read occurs in the XQueryDeviceState() function of libXi prior to version 1.8.4. The flaw allows an attacker to read memory data beyond the intended buffer boundaries, potentially exposing sensitive information such as session tokens, authentication credentials, or other confidential data that reside in the memory of the X server process. The weakness is identified as CWE‑125 and corresponds to a moderate CVSS score of 6.5, indicating that while it does not enable arbitrary code execution, it can compromise the confidentiality of data handled by the X server.

The issue affects the libXi library distributed by X.org. All releases before version 1.8.4 are vulnerable, including the standard packages found in most Linux distributions that ship an older libXi. Systems running legacy X server environments that still ship the older library should upgrade to 1.8.4 or later to eliminate the risk.

The CVSS score of 6.5 reflects a medium impact on confidentiality. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not been widely exploited. The flaw can be triggered by any client that can invoke XQueryDeviceState() on the X server, which is generally available to local users or any client for which the X server accepts network connections. Therefore the attack vector is likely local or remote within the X network, and the exploitation requires the ability to send crafted requests to the server. Privileged or compromised clients could use this read to infer memory contents or sensitive information.