CVE-2026-94281
published 2026-09-24CVE-2026-94281: An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
PriorityP429medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.21%
11.5th percentile
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| x.org | libxi | < 1.8.4 | 1.8.4 |
| x.org | libxi | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()
vendor_redhat·2026-09-24·CVSS 6.5
CVE-2026-94281 [MEDIUM] CWE-125 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()
libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
A flaw was found in libXi. An out-of-bounds read vulnerability exists in the XListInputDevices() function during the parsing of input device classes. A malicious X server can exploit this flaw by returning crafted device information, causing an attached X client application to crash and resulting in a Denial of Service (DoS).
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, o
GHSA
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
ghsa_unreviewed·2026-09-24
CVE-2026-94281 [MEDIUM] CWE-125 An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-94281 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()
bugzilla·2026-09-24·CVSS 6.5
CVE-2026-94281 [MEDIUM] CVE-2026-94281 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()
CVE-2026-94281 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices()
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Bugzilla
CVE-2026-94281 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices() [fedora-all]
bugzilla·2026-09-24·CVSS 6.5
CVE-2026-94281 [MEDIUM] CVE-2026-94281 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices() [fedora-all]
CVE-2026-94281 libXi: libXi: Denial of Service via out-of-bounds read in XListInputDevices() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
2026-09-24
Published