libXi CVE-2026-93541

Exploitation requires the victim to run a libXi-based X11 client (version before 1.8.4) that connects to an attacker-controlled or compromised X server, or an attacker who can tamper with an unauthenticated/unencrypted X protocol connection to inject a crafted XQueryDeviceState() reply. This is the UI:R limiter: there is no unsolicited remote trigger against a listening service - the client must initiate the connection to the malicious endpoint. Impact is limited to crashing the client application (denial of service); no code execution or confirmed data disclosure. Deployments where clients only connect to trusted local X servers are effectively not exposed.

This is a moderate-severity, availability-only defect. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5) is notable in that it records ONLY an availability impact (A:H) with no confidentiality or integrity loss - despite the CWE-125 out-of-bounds read classification, which would normally imply at least C:L information leakage. This tension suggests the practical outcome is a client crash rather than a memory disclosure; the truncated description ('could be used by a...') leaves the exact primitive unstated and should be confirmed against the vendor merge request. The threat model is inverted from a typical network service: libXi is a CLIENT-side library, so exploitation requires a malicious or compromised X server (or a hijacked X connection) returning crafted reply data to XQueryDeviceState(), which is why UI:R is set. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied data, so there is no public exploit identified at time of analysis. Overall this is a real but low-urgency issue: unauthenticated network vector is offset by the requirement to trick a client into connecting to an attacker-controlled server, and the impact ceiling is denial of service, not code execution or data theft.

A user runs an X11 client application (built against libXi < 1.8.4) that connects to a malicious or compromised X server, or an attacker performs a man-in-the-middle on an unencrypted X connection. The rogue server replies to an XQueryDeviceState() request with crafted length/count fields that drive an out-of-bounds read in the client, crashing the application. No public proof-of-concept is referenced in the available data.