Heap Overflow Vulnerability in LibXi Affects X Server Communication
CVE-2026-109090

7.5HIGH

Key Information:

Vendor

X.org

Status
Libxi
Vendor
CVE Published:
27 October 2026

What is CVE-2026-109090?

A vulnerability exists in libXi where a malicious X server can exploit a heap overflow by injecting an oversized DEVICE_ENABLE reply. This issue affects versions prior to 1.8.4, highlighting the need for users to ensure they are using the latest software to mitigate potential security risks.

Affected Version(s)

libXi 0 < 1.8.4

References

https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4e...
patch

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Bedard
.