Red Hat Security Advisory

RHSA-2026:93439

libXi security update

Released 2026-11-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) libXi-1.7.10-8.el9_8.3, libXi-devel-1.7.10-8.el9_8.3

TI-2026-81426 CVE-2026-109090 · GHSA-5h6f-wh6v-848r

LOW 34

A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00258 Published 2026-10-27 Partial fix · 1.8.4 CWE-122

TI-2026-81414 CVE-2026-109089 · GHSA-xv92-4rh8-wp3r

LOW 34

A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00258 Published 2026-10-27 Partial fix · 1.8.4 CWE-122