libXi contains an out-of-bounds read in the function that parses input device lists. When an X server provides a malformed device descriptor, the library reads beyond the intended buffer, causing an X client to crash. The flaw does not grant code execution, credentials disclosure, or network traversal, but it can be triggered by a malicious X server to force arbitrary attached X clients to terminate, thereby disrupting services and availability.

The vulnerability afflicts the libXi library distributed by the X.Org Foundation. Versions older than 1.8.4 are affected. All clients using these versions of libXi to interface with an X server are potentially exposed.

The CVSS score of 6.5 indicates moderate severity. There is no EPSS score available, and the vulnerability is not listed in the CISA KEV catalog. It can be exploited by any X server that an application connects to, including remote servers if the client accepts inbound connections. The attack requires only the ability to feed crafted device information to the client, a capability that a malicious or compromised X server can provide. The risk observation is that while the impact is limited to service disruption, the breadth of affected systems and the ease of triggering the crash make it a non‑negligible threat.