Executive brief
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
Junglewise Threat Intelligence
CVE-2026-94281: An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an at
CVE-2026-94281 · Severity: medium · CVSS 6.5 · Published 2026-09-24