CVE-2026-93543
published 2026-09-24CVE-2026-93543: An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
PriorityP433high7.4CVSS 3.1
AVNACLPRNUIRSCCNINAH
EPSS
0.26%
17.8th percentile
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| x.org | libxi | < 1.8.4 | 1.8.4 |
| x.org | libxi | — | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser
vendor_redhat·2026-09-24·CVSS 7.4
CVE-2026-93543 [HIGH] CWE-125 libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser
libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
A flaw was found in libXi. An out-of-bounds read vulnerability in the X Input 2 (XI2) class parser allows a malicious X server to cause a Denial of Service (DoS) by crashing connected client applications. When an application receives and processes specially crafted input from the server, insufficient boundary checking causes the client to read beyond memory limits and terminate unexpectedly.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, a
GHSA
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
ghsa_unreviewed·2026-09-24
CVE-2026-93543 [HIGH] CWE-125 An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-93543 libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser
bugzilla·2026-09-24·CVSS 7.4
CVE-2026-93543 [HIGH] CVE-2026-93543 libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser
CVE-2026-93543 libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Bugzilla
CVE-2026-93543 libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser [fedora-all]
bugzilla·2026-09-24·CVSS 7.4
CVE-2026-93543 [HIGH] CVE-2026-93543 libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser [fedora-all]
CVE-2026-93543 libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
2026-09-24
Published