Is CVE-2026-94282 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94282 being exploited in the wild.

How severe is CVE-2026-94282?

Medium severity, with a CVSS score of 5.6, published 28 September 2026.

Which products and versions are affected?

Freedesktop libXi before 1.8.4.

Is there a fix for CVE-2026-94282?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Am I affected by CVE-2026-94282?

Check whether you run Freedesktop libXi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94282: libXi out-of-bounds read in XI2 enter/leave/focus event parsing

CVE-2026-94282 · Severity: medium · CVSS 5.6 · Published 2026-09-28

libXi is a library that X11 client applications use to communicate with the X server for input device handling. A malicious X server can craft specially formatted enter/leave/focus events that cause an out-of-bounds memory read in the client library, crashing any X client that receives them. This could be exploited to deny service to X applications.

Vendors: Freedesktop.

Quick answers

Is CVE-2026-94282 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94282 being exploited in the wild.
How severe is CVE-2026-94282?: Medium severity, with a CVSS score of 5.6, published 28 September 2026.
Which products and versions are affected?: Freedesktop libXi before 1.8.4.
Is there a fix for CVE-2026-94282?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-94282 attacked?: It is in a software library.
Am I affected by CVE-2026-94282?: Check whether you run Freedesktop libXi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an out-of-bounds read in the wireToEnterLeave() function during XI2 event conversion. The function processes enter/leave/focus cookie events without properly validating that the buttons_len field does not exceed the available event data, leading to reads beyond allocated buffers. A malicious X server can trigger this by sending a crafted xXIEnterEvent with an inflated buttons_len value, causing the client to crash or potentially disclose memory.

Affected products

freedesktop libXi before 1.8.4

Timeline

2026-09-28: disclosed

References

https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=cecf160e9731fe01f3632f875f29ffcb598b052a

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.