Description
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Published: 2026-09-24
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

An out‑of‑bounds read in XListInputDevices() can crash any X client that connects to a malicious X server. The flaw allows the attacker's server to trigger an invalid memory access within the client, leading to a crash but not to code execution or data disclosure.

Affected Systems

The vulnerability affects the X.Org libXi library, versions prior to 1.8.4, used by X Server deployments on Linux and other Unix‑like operating systems.

Risk and Exploitability

The CVSS score is 6.5, and the EPSS score is not available, indicating the risk level is moderate. The flaw is not listed in CISA KEV, and no public exploit has been reported. Based on the description, the likely attack vector involves a malicious X server controlling an X client, which could be local or on the same host where the client runs.

Generated by OpenCVE AI on September 25, 2026 at 05:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libXi to version 1.8.4 or later to eliminate the out‑of‑bounds read.
  • Restart the X server to ensure the updated library is loaded.
  • Configure the X server to restrict client connections to trusted sources, thereby reducing exposure to malicious X servers.

Generated by OpenCVE AI on September 25, 2026 at 05:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 24 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Title Out-of-bounds read in libXi's XListInputDevices()
First Time appeared X.org
X.org libxi
Weaknesses CWE-125
CPEs cpe:2.3:a:x.org:libxi:*:*:*:*:*:*:*:*
Vendors & Products X.org
X.org libxi
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

X.org Libxi
cve-icon MITRE

Status: PUBLISHED

Assigner: suse

Published:

Updated: 2026-09-24T17:14:46.750Z

Reserved: 2026-09-18T09:08:10.295Z

Link: CVE-2026-93545

cve-icon Vulnrichment

Updated: 2026-09-24T17:14:38.847Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-24T17:17:10.550

Modified: 2026-09-24T21:00:46.893

Link: CVE-2026-93545

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-24T16:20:35Z

Links: CVE-2026-93545 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T05:15:17Z

Weaknesses