CVE-2026-94282
published 2026-09-28CVE-2026-94282: An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X…
PriorityP422medium5.6CVSS 3.1
AVLACLPRLUIRSUCLINAH
EPSS
0.13%
2.2th percentile
An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| x.org | libxi | < 1.8.4 | 1.8.4 |
| x.org | libxi | — | — |
CVSS provenance
nvdv3.15.6MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libXi: OOB read in XI2 enter/leave/focus cookie conversion (`wireToEnterLeave`)
vendor_redhat·2026-09-14·CVSS 6.1
CVE-2026-94282 [MEDIUM] libXi: OOB read in XI2 enter/leave/focus cookie conversion (`wireToEnterLeave`)
libXi: OOB read in XI2 enter/leave/focus cookie conversion (`wireToEnterLeave`)
No description is available for this CVE.
Package: libXi (Red Hat Enterprise Linux 10) - Under investigation
GHSA
An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.
ghsa_unreviewed·2026-09-28
CVE-2026-94282 [MEDIUM] CWE-125 An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.
An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.
No detection rules found.
No public exploits indexed.
2026-09-28
Published