CVE-2026-93544: An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attac

CVE-2026-93544 · Severity: medium · CVSS 6.5 · Published 2026-09-24

Executive brief

An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.