Live › vulnerability › CVE-2026-109090
Go to dashboardlibXi, the X Input extension client library, can overflow a heap buffer when it processes a DEVICE_ENABLE reply from an X server. A malicious X server can send an oversized reply to trigger the overflow, which may let it run code in the client application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Applications and desktop components on Linux and Unix systems that link libXi and connect to an X server. The risk depends on trusting the X server, so systems that only use a trusted local display have lower exposure. unknown whether the sources give exact affected distributions.
No product ranges from the sources yet.
pkg-config --modversion xi to see the installed libXi version1.8.4 or later through your OS package managerEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-109090")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.