{"id":"CVE-2026-109090","kind":"vulnerability","aliases":["CVE-2026-109090"],"related":[],"title":"libXi: malicious X server causes heap overflow via DEVICE_ENABLE reply","description":"A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.","summary":"libXi, the X Input extension client library, can overflow a heap buffer when it processes a DEVICE_ENABLE reply from an X server. A malicious X server can send an oversized reply to trigger the overflow, which may let it run code in the client application.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","libxi","linux","x11"],"not_affected_if":["no-x11-clients","wayland-only"],"how_to_check":"- `pkg-config --modversion xi` to see the installed libXi version\n- Check whether your distribution package for libXi is older than the fixed release","fix":"- Upgrade libXi to `1.8.4` or later through your OS package manager","status":"open","published_at":"2026-10-27T17:16:57+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:38+00:00","updated_at":"2026-10-27T17:34:38+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T17:34:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade libXi to `1.8.4` or later through your OS package manager","reach":"network","title":"libXi: malicious X server causes heap overflow via DEVICE_ENABLE reply","impact":"high","summary":"libXi, the X Input extension client library, can overflow a heap buffer when it processes a DEVICE_ENABLE reply from an X server. A malicious X server can send an oversized reply to trigger the overflow, which may let it run code in the client application.","category":"infrastructure","nicknames":[],"who_cares":["linux","x11","libxi"],"confidence":0.6,"needs_auth":"no","worst_case":"Client process memory corrupted; possible code execution in the client","analyst_note":"Confirm whether exploitation needs a fully malicious X server or a MITM, and which distributions shipped the fix; the NVD entry is the only source.","how_to_check":"- `pkg-config --modversion xi` to see the installed libXi version\n- Check whether your distribution package for libXi is older than the fixed release","needs_analyst":true,"not_affected_if":["wayland-only","no-x11-clients"],"who_is_affected":"Applications and desktop components on Linux and Unix systems that link libXi and connect to an X server. The risk depends on trusting the X server, so systems that only use a trusted local display have lower exposure. unknown whether the sources give exact affected distributions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000584,"input_tokens":3270,"output_tokens":515,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109090':14A,17A '-2026':13A,16A '1.8.4':89C 'applic':67B 'buffer':33B 'caus':5A,73C 'client':27B,66B 'code':63B 'could':72C 'cve':12A,15A 'devic':9A,38B,81C 'enabl':10A,39B,82C 'extens':26B 'heap':6A,32B,75C 'infrastructur':18B 'inject':78C 'input':25B 'larg':80C 'let':60B 'librari':28B 'libxi':1A,19B,22B,87C 'linux':20B 'malici':2A,46B,69C 'may':59B 'overflow':7A,30B,57B,76C 'overs':52B 'process':36B,85C 'repli':11A,40B,53B,83C 'run':62B 'send':50B 'server':4A,44B,48B,71C 'trigger':55B 'via':8A 'x':3A,24B,43B,47B,70C 'x11':21B","nicknames":[],"mitigations":[],"who_affected":"Applications and desktop components on Linux and Unix systems that link libXi and connect to an X server. The risk depends on trusting the X server, so systems that only use a trusted local display have lower exposure. unknown whether the sources give exact affected distributions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109090","severity":null,"published_at":"2026-10-27T17:16:57+00:00","modified_at":"2026-10-27T17:16:57+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}