An out‑of‑bounds read occurs in libXi’s XI2 class parser before version 1.8.4. When a malicious X server sends crafted XI2 class data, the parser can read past the bounds of a buffer, leading to a crash of any X client that is attached to that server. This vulnerability is a classic buffer read overflow (CWE‑125) and can cause availability loss for users relying on X client applications.

The vulnerability affects the x.org:libXi product. Systems running libXi prior to version 1.8.4 are susceptible. No specific sub‑versions are listed beyond the 1.8.4 cutoff, so any build that does not contain the 1.8.4 or newer fix is considered vulnerable.

The CVSS score of 7.4 marks it as a high‑severity issue. Because the EPSS score is not available, the current likelihood of exploitation cannot be quantified, and it is not yet listed in the CISA KEV catalog. The attack vector is inferred to be an attacker controlling an X server that communicates with the client; the malicious server must establish a connection to trigger the crash. The exploit is purely an availability disruption without direct code execution or data disclosure.