Read the docs
TI-2026-81426 Aliases CVE-2026-109090GHSA-5h6f-wh6v-848r

Heap overflow in libXi XGetDeviceControl DEVICE_ENABLE reply

Priority LOW 34CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

libXi before 1.8.4 contains a heap-based buffer overflow (CWE-122) in how it handles DEVICE_ENABLE replies returned by XGetDeviceControl. A malicious X server can send an oversized DEVICE_ENABLE reply that overflows a heap buffer when libXi processes it. Exploitation requires user interaction and high attack complexity, and it can impact confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00258 17th percentileScored 2026-11-07
Fix Partial libXi (x.org): 1.8.4Red Hat: 4 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
x.orglibXibefore 1.8.41.8.4Patch availableCNA
  • libXi Vendorx.org Affected before 1.8.4 Fixed in 1.8.4 Patch available CNA

Remediation

Upgrade libXi to 1.8.4. Red Hat fixes Red Hat Enterprise Linux AppStream v. 8, 9 and 10 in RHSA-2026:93438, RHSA-2026:93439 and RHSA-2026:93441, and Red Hat Hardened Images in RHSA-2026:86772. Red Hat Enterprise Linux 7 is affected without a fix, and Red Hat lists no plan for it.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA libXi (x.org) Fixed in 1.8.4

Red Hat 4 advisories

  • RHSA-2026:93439 Released 2026-11-02 · Red Hat rating Important
    libXi security update
    • Red Hat Enterprise Linux AppStream (v. 9) libXi-1.7.10-8.el9_8.3, libXi-devel-1.7.10-8.el9_8.3
  • RHSA-2026:93438 Released 2026-11-02 · Red Hat rating Important
    libXi security update
    • Red Hat Enterprise Linux AppStream (v. 8) libXi-1.7.10-4.el8_10, libXi-devel-1.7.10-4.el8_10
  • RHSA-2026:93441 Released 2026-11-02 · Red Hat rating Important
    libXi security update
    • Red Hat Enterprise Linux AppStream (v. 10) libXi-1.8.1-7.el10_2.3, libXi-devel-1.8.1-7.el10_2.3
Show 1 more Red Hat advisories
  • RHSA-2026:86772 Released 2026-10-21 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libXi-1.8.4-1.hum1@aarch64, libXi-1.8.4-1.hum1@s390x, libXi-1.8.4-1.hum1@src +4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    X.Org libXi 1.8.4

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-81414 Heap buffer overflow in libXi when handling DEVICE_RESOLUTIONPriority LOW 34
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:93441
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:93438
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:93439
Red Hat Hardened ImagesFixed RHSA-2026:86772
Not affected: 1 product
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-109090
  2. 2026-10-27 Alias added: GHSA-5h6f-wh6v-848r
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-02 Affected versions changed · Red Hat
  5. 2026-11-02 CVSS score added · Red Hat
  6. 2026-11-02 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
  7. 2026-11-03 Fix available: RHSA-2026:93441 · Red Hat
  8. 2026-11-03 Fix available: RHSA-2026:93439 · Red Hat
  9. 2026-11-03 Fix available: RHSA-2026:93438 · Red Hat
  10. 2026-11-03 Fix available: RHSA-2026:86772 · Red Hat
  11. 2026-11-03 Fix available: Red Hat Hardened Images · Red Hat
  12. 2026-11-04 CISA SSVC decision points changed

References

Patch 1

  • TI-2022-25238 In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for… CVSS 3.1HIGH 7.7
  • TI-1999-00519 An X server's access control is disabled (e.g. CVSS 2.0HIGH 10.0
  • TI-2021-11657 LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote… CVSS 3.1CRITICAL 9.8
  • TI-2018-10465 An issue was discovered in libX11 through 1.6.5. CVSS 3.0CRITICAL 9.8
  • TI-2004-00826 Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other… CVSS 2.0HIGH 10.0
  • TI-2016-08240 Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM… CVSS 3.0CRITICAL 9.8
See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences