CVE-2026-109090
libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
- Record
CVE-2026-109090- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-04
EUVDEUVD-2026-111111
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
- Record
EUVD-2026-111111- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-5h6f-wh6v-848r
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when...
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
- Record
GHSA-5h6f-wh6v-848r- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
- Record
CVE-2026-109090- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-04
OSVALPINE-CVE-2026-109090
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
- Record
ALPINE-CVE-2026-109090- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2026-109090
- Record
BELL-CVE-2026-109090- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
Show 17 moreShow less
OSV
libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
- Record
CVE-2026-109090- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-109090
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
- Record
DEBIAN-CVE-2026-109090- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVOESA-2026-4504
libXi security update
libXi is the client-side library for the X Input Extension.
Security Fix(es):
X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.(CVE-2026-109089)
X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.(CVE-2026-109090)
- Record
OESA-2026-4504- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4609
libXi security update
libXi is the client-side library for the X Input Extension.
Security Fix(es):
X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.(CVE-2026-109089)
X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.(CVE-2026-109090)
- Record
OESA-2026-4609- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4610
libXi security update
libXi is the client-side library for the X Input Extension.
Security Fix(es):
X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.(CVE-2026-109089)
X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.(CVE-2026-109090)
- Record
OESA-2026-4610- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4611
libXi security update
libXi is the client-side library for the X Input Extension.
Security Fix(es):
X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.(CVE-2026-109089)
X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for.(CVE-2026-109090)
- Record
OESA-2026-4611- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:93438
Important: libXi security update
X.Org X11 libXi runtime library
Security Fix(es):
-
libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090)
-
libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:93438- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVRLSA-2026:93439
Important: libXi security update
X.Org X11 libXi runtime library
Security Fix(es):
-
libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090)
-
libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:93439- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVRLSA-2026:93441
Important: libXi security update
X.Org X11 libXi runtime library
Security Fix(es):
-
libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090)
-
libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:93441- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2026-109090
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
- Record
UBUNTU-CVE-2026-109090- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:93438 No score
Important: libXi security update
X.Org X11 libXi runtime library
Security Fix(es):
- libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090)
- libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:93438- Updated
- 2026-11-03
OSVALSA-2026:93439 No score
Important: libXi security update
X.Org X11 libXi runtime library
Security Fix(es):
- libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090)
- libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:93439- Updated
- 2026-11-03
OSVALSA-2026:93441 No score
Important: libXi security update
X.Org X11 libXi runtime library
Security Fix(es):
- libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090)
- libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:93441- Updated
- 2026-11-03
OSVAZL-111169 No score
CVE-2026-109090 affecting package libXi for versions less than 1.8.4-1
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
- Record
AZL-111169- Updated
- 2026-11-05
OSVMGASA-2026-0543 No score
Updated libxtst, libxrender, libxi packages fix security vulnerabilities
The updated packages fix security vulnerabilities: libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow. (CVE-2026-109089) libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow. (CVE-2026-109090) Out-of-bounds read in libXrender's XRenderQueryFormat reply parser. (CVE-2026-88807) libXtst RECORD EnableContext Reply Endless Loop. (CVE-2026-109088)
- Record
MGASA-2026-0543- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12154-1 No score
libXi-devel-1.8.3-3.1 on GA media
These are all security issues fixed in the libXi-devel-1.8.3-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12154-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24366-1 No score
Security update for libXi
This update for libXi fixes the following issues:
- CVE-2026-93541: Out-of-bounds read in libXi's XQueryDeviceState() (bsc#1281605).
- CVE-2026-93542: Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() (bsc#1281606).
- CVE-2026-93543: Out-of-bounds read in libXi's XI2 class parser (bsc#1281608).
- CVE-2026-93544: Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing (bsc#1281609).
- CVE-2026-93545: Out-of-bounds read in libXi's XListInputDevices() (bsc#1281612).
- CVE-2026-94281: Out-of-bounds read in libXi's XListInputDevices() class parsing (bsc#1281615).
- CVE-2026-94282: Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion (bsc#1281651).
- CVE-2026-109089: XGetDeviceControl Control Type Mismatch Heap Buffer Overflow (bsc#1285084).
- CVE-2026-109090: XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow (bsc#1285085).
- Record
SUSE-SU-2026:24366-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libxiAlpine:v3.24 |
before 1.8.4-r0 | 1.8.4-r0 |
libXiAlmaLinux:8 From an advisory covering 2 CVEs |
before 1.7.10-4.el8_10 | 1.7.10-4.el8_10 |
libXi-develAlmaLinux:8 From an advisory covering 2 CVEs |
before 1.7.10-4.el8_10 | 1.7.10-4.el8_10 |
libXiAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.7.10-8.el9_8.3 | 1.7.10-8.el9_8.3 |
libXi-develAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.7.10-8.el9_8.3 | 1.7.10-8.el9_8.3 |
libXiAlmaLinux:10 From an advisory covering 2 CVEs |
before 1.8.1-7.el10_2.3 | 1.8.1-7.el10_2.3 |
libXi-develAlmaLinux:10 From an advisory covering 2 CVEs |
before 1.8.1-7.el10_2.3 | 1.8.1-7.el10_2.3 |
libXiAzure Linux:3 |
before 1.8.4-1 | 1.8.4-1 |
libxiAlpaquita:23 |
1.8-r0 up to 1.8.4-r0 | 1.8.4-r0 |
libxiAlpaquita:25 |
1.8.2-r0 up to 1.8.4-r0 | 1.8.4-r0 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libxiAlpaquita:stream |
1.8-r0 up to 1.8.4-r0 | 1.8.4-r0 |
libxiDebian:12 |
All versions, plus listed versions 2:1.8-12:1.8-1+hurd.12:1.8.1-12:1.8.2-12:1.8.2-22:1.8.3-12:1.8.4-1 |
None known |
libxiDebian:13 |
All versions, plus listed versions 2:1.8.2-12:1.8.2-22:1.8.3-12:1.8.4-1 |
None known |
libxiDebian:14 |
before 2:1.8.4-1, plus listed versions 2:1.8.2-12:1.8.2-22:1.8.3-1 |
2:1.8.4-1 |
libxtstMageia:10 From an advisory covering 4 CVEs |
before 1.2.5-2.2.mga10 | 1.2.5-2.2.mga10 |
libxrenderMageia:10 From an advisory covering 4 CVEs |
before 0.9.12-2.1.mga10 | 0.9.12-2.1.mga10 |
libxiMageia:10 From an advisory covering 4 CVEs |
before 1.8.2-2.2.mga10 | 1.8.2-2.2.mga10 |
libXiopenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.8-5.oe2203sp4 | 1.8-5.oe2203sp4 |
libXiopenEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 1.8.1-6.oe2403sp3 | 1.8.1-6.oe2403sp3 |
libXiopenEuler:24.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.8.1-6.oe2403sp4 | 1.8.1-6.oe2403sp4 |
libXiopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 1.8.1-6.oe2403sp1 | 1.8.1-6.oe2403sp1 |
libXiRocky Linux:8 From an advisory covering 2 CVEs |
before 0:1.7.10-4.el8_10 | 0:1.7.10-4.el8_10 |
libXiRocky Linux:9 From an advisory covering 2 CVEs |
before 0:1.7.10-8.el9_8.3 | 0:1.7.10-8.el9_8.3 |
libXiRocky Linux:10 From an advisory covering 2 CVEs |
before 0:1.8.1-7.el10_2.3 | 0:1.8.1-7.el10_2.3 |
libXiSUSE:Linux Micro 6.0 From an advisory covering 9 CVEs |
before 1.8.1-159998.1.1 | 1.8.1-159998.1.1 |
libxiUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:1.7.4-12:1.7.5-12:1.7.6-12:1.7.6-1ubuntu0.1~esm1 |
None known |
libxiUbuntu:18.04:LTS |
All versions, plus listed versions 2:1.7.9-1 |
None known |
libxiUbuntu:20.04:LTS |
All versions, plus listed versions 2:1.7.10-0ubuntu1 |
None known |
libxiUbuntu:22.04:LTS |
All versions, plus listed versions 2:1.7.10-1build22:1.7.10-1build32:1.8-12:1.8-1build1 |
None known |
libxiUbuntu:24.04:LTS |
All versions, plus listed versions 2:1.8-1build12:1.8.1-12:1.8.1-1build1 |
None known |
libxiUbuntu:26.10 |
All versions, plus listed versions 2:1.8.2-2 |
None known |
libxiUbuntu:26.04:LTS |
All versions, plus listed versions 2:1.8.2-12:1.8.2-2 |
None known |
libXiopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.8.3-3.1 | 1.8.3-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, EUVD, NVD, OSV | |
| affected | OSV | |
| affected, facts | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-109090 is a high vulnerability (CVSS 7.5) in X.org Libxi, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in libxi 1.8.4-r0.
References
gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b6
nvd.nist.gov/vuln/detail/CVE-2026-109090
github.com/advisories/GHSA-5h6f-wh6v-848r
security.alpinelinux.org/vuln/CVE-2026-109090
access.redhat.com/errata/RHSA-2026:93438
Show 46 moreShow less
errata.almalinux.org/8/ALSA-2026-93438.html
docs.bell-sw.com/security/cves/CVE-2026-109090
security-tracker.debian.org/tracker/CVE-2026-109090
advisories.mageia.org/MGASA-2026-0543.html
bugs.mageia.org/show_bug.cgi?id=36533
openwall.com/lists/oss-security/2026/10/16/37
lists.x.org/archives/xorg-announce/2026-October/thread.html
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4504
errata.rockylinux.org/RLSA-2026:93438
bugzilla.redhat.com/show_bug.cgi?id=2562069
suse.com/support/update/announcement/2026/suse-su-202624366-1
bugzilla.suse.com/1281605
ubuntu.com/security/CVE-2026-109090
cve.org/CVERecord?id=CVE-2026-109090