An out-of-bounds read occurs during the parsing of XIQueryDevice replies in libXi before version 1.8.4. The vulnerability can be triggered by a malicious X server that sends a crafted reply, which causes an attached X client to read beyond memory bounds and crash. The resulting denial of service can disrupt visual applications that rely on the X server, but there is no evidence of privilege escalation or data disclosure.

The affected product is libXi from x.org. Any system running libXi earlier than version 1.8.4 is susceptible. This includes Linux desktops and servers that use the X Window System and rely on libXi for input extension functionality.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, so the current exploitation likelihood is unclear. The vulnerability is not listed in CISA’s KEV catalog, which suggests no confirmed widespread exploitation. An attacker would need control over an X server that communicates with the vulnerable client, so the attack vector is local or network‑based depending on the X server’s exposure.