Zero Radar
← feed
HighVulnerabilityCVE-2026-109090updated 27 Oct 2026, 21:16 UTC

X Input library (libXi) can overflow memory when a malicious X server responds

A program using the libXi input library can be crashed or possibly taken over if it connects to a malicious display server. The library trusts an oversized reply from that server and writes past the end of its memory buffer.

Fixed in libXi 1.8.4 or laterOfficial, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?Not knownNo attacks reported so far
Fix available?YeslibXi 1.8.4 or later · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Malicious X serverAttacker runs a rogue display server
  2. 2Client connectsApplication connects to the rogue server
  3. 3Oversized replyServer sends a large DEVICE_ENABLE reply
  4. 4Heap overflowlibXi writes past its memory buffer
  5. ResultClient memory corrupted, possible code execution

What happened

A heap overflow in libXi (X11 X Input extension client library) is triggered by a large DEVICE_ENABLE reply injected by a malicious X server, affecting versions before 1.8.4.

Why it is dangerous: A crafted X server can corrupt memory in client applications, which may cause crashes or potentially allow code execution, affecting desktop users and programs that connect to untrusted X servers.

Are you affected?

You are affected if you use libXi before 1.8.4 and connect to X servers you do not fully trust.

libXi (X.Org X11 Input library) versions before 1.8.4

What to do

  1. Update libXi to version 1.8.4 or later through your system's package manager
  2. Avoid connecting to untrusted or unknown X servers until patched
  3. Check your installed libXi version with your distribution's package tools

Timeline

  1. 27 Oct 2026, 17:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 17:16 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 17:20 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 21:16 UTC
    oss-security reported on it · oss-security

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-109090
CVSS
7.5 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 17:16 UTC
On Zero Radar
27 Oct 2026, 17:20 UTC (4 min after disclosure)
Last change
27 Oct 2026, 21:16 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

X Input library (libXi) can overflow memory when a malicious X server responds · Zero Radar