CVE-2026-93545
published 2026-09-24CVE-2026-93545: An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
PriorityP428medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.21%
11.5th percentile
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| x.org | libxi | < 1.8.4 | 1.8.4 |
| x.org | libxi | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
ghsa_unreviewed·2026-09-24
CVE-2026-93545 [MEDIUM] CWE-125 An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Red Hat
libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()
vendor_redhat·2026-09-24·CVSS 6.5
CVE-2026-93545 [MEDIUM] CWE-125 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()
libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
A flaw was found in libXi. An out-of-bounds read vulnerability in the XListInputDevices() function allows a malicious X server to crash connected client applications. By returning specially crafted input device data when a client requests device information, the server can trigger an application crash, resulting in a Denial of Service (DoS).
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base,
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-93545 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices() [fedora-all]
bugzilla·2026-09-24·CVSS 6.5
CVE-2026-93545 [MEDIUM] CVE-2026-93545 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices() [fedora-all]
CVE-2026-93545 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Bugzilla
CVE-2026-93545 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()
bugzilla·2026-09-24·CVSS 6.5
CVE-2026-93545 [MEDIUM] CVE-2026-93545 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()
CVE-2026-93545 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
2026-09-24
Published