Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-93544: libXi can crash if X server is malicious
CVE-2026-93544 · published 1 month ago
Summary
The libXi library, used by X11 graphics on Linux, can read data incorrectly when it receives a malformed reply from a compromised X server, causing the client application to crash. This can disrupt users and services that rely on graphical applications. Upgrade libXi to version 1.8.4 or later to fix the problem.
What to do
- Update libxi to version 1.8.4-r0.
- Update bellsoft libxi to version 1.8.4-r0.
- Update debian libxi to version 2:1.8.4-1.
- Update x.org libxi to version 1.8.4 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | x.org | libxi | < 1.8.4 |
| Ubuntu:Pro:16.04:LTS | canonical | libxi | All versions |
| Debian:12 | debian | libxi | All versions |
| Alpine:v3.24 | – | libxi |
< 1.8.4-r0 Fix: upgrade to 1.8.4-r0
|
| Alpaquita:stream | bellsoft | libxi |
>= 1.8-r0, < 1.8.4-r0 Fix: upgrade to 1.8.4-r0
|
| Debian:14 | debian | libxi |
< 2:1.8.4-1 Fix: upgrade to 2:1.8.4-1
|
| Alpaquita:25 | bellsoft | libxi |
>= 1.8.2-r0, < 1.8.4-r0 Fix: upgrade to 1.8.4-r0
|
Original advisory text
BELL-CVE-2026-93544
An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.
References
- https://ubuntu.com/security/CVE-2026-93544 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-93544 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-93544 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93544... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-93544 Vendor Advisory
- https://gitlab.freedesktop.org/xorg/lib/libxi Product
- https://security.alpinelinux.org/vuln/CVE-2026-93544 Vendor Advisory
- https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_i... Patch
- https://docs.bell-sw.com/security/cves/CVE-2026-93544 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-125Out-of-bounds Read
Timeline
Published25 Sep 2026
Updated4 Nov 2026
First seen24 Sep 2026
Sources
CVE-2026-93544 · NVD
CVE-2026-93544 · MITRE
UBUNTU-CVE-2026-93544 · OSV
DEBIAN-CVE-2026-93544 · OSV
CVE-2026-93544 · OSV
ALPINE-CVE-2026-93544 · OSV
BELL-CVE-2026-93544 · OSV
Track software like this
Free during beta