An out-of-bounds read occurs in the XI2 enter/leave/focus cookie conversion routine of libXi before version 1.8.4. The vulnerability allows a malicious X server to send malformed XI2 event data to an X client, causing the client to read memory beyond the intended buffer and ultimately crash. The impact is a denial of service on the affected X application, with no direct route to code execution, privilege escalation, or data disclosure.

The flaw resides in the libXi component of the X.Org X11 server. Any client application that links against libXi and processes XI2 enter, leave, or focus events is potentially affected. Versions of libXi older than 1.8.4 may be vulnerable; releases 1.8.4 and later contain the patch.

The CVSS score of 5.6 classifies this as a medium severity vulnerability. EPSS is not available and the vulnerability is not listed in CISA KEV, indicating no known exploitation. The likely attack vector involves an attacker who can control or influence the X server to send crafted XI2 event data to a listening X client; this inference is drawn from the description that a malicious X server can trigger the crash. An attacker would need local or remote access to the X server or the ability to inject payloads into the XI2 event stream. The vulnerability does not provide a path to privilege escalation or data exfiltration; it simply terminates the client, leading to service disruption.