Live › vulnerability › CVE-2026-109089
Go to dashboardlibXi versions before 1.8.4 contain a buffer overflow when parsing DEVICE_RESOLUTION replies, which can overflow a heap buffer. A malicious X server can trigger it, which may let an attacker corrupt memory in the client program.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Programs that use libXi to talk to an X server, such as desktop sessions and X11 clients on Linux and BSD systems. Exposure depends on connecting to an X server the attacker controls, so machines that only use Wayland or never open X connections to untrusted servers are less likely to be at risk. unknown whether the sources list specific affected distributions.
No product ranges from the sources yet.
xdpyinfo or pkg-config --modversion xi to find the installed libXi versiondpkg -l libxi6 or rpm -q libXi1.8.4 or later through your OS package managerEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.
This page as .md · .json · in your agent: get_signal("CVE-2026-109089")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.