libXi CVE-2026-93542

Exploitation requires the victim's X client (using libXi before 1.8.4) to connect to a malicious or compromised X server that returns crafted XI2 device-class data parsed by size_classes()/copy_classes(). The limiting factors are significant: the attack inverts the normal X11 trust model (server attacks client), so it only applies when a user connects to an untrusted display server - for example a remote/forwarded X session or a compromised server - and requires user interaction (UI:R) to establish that connection. Clients bound to a trusted local X server, the common case, are not realistically exposed. Impact is confined to crashing the client process (availability); no code execution, data disclosure, or integrity compromise results.

This is a genuine but limited-severity issue best characterized as a client-side denial-of-service, not a widespread priority threat. The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) rests entirely on availability impact - there is no confidentiality or integrity impact - and depends on an inverted trust model: a MALICIOUS or compromised X SERVER crashes an X CLIENT that connects to it, the reverse of the usual server-attacks-client assumption. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The AV:N rating is technically defensible (X11 can run over the network) but is largely theoretical in modern deployments where clients connect to a trusted local display server; the realistic vector requires a user to point their X client at an attacker-controlled server (hence UI:R). Net: a real bug worth patching in routine maintenance, but the DoS-only impact, required user interaction, and inverted/non-default trust scenario keep real-world risk well below what a 6.5 might superficially suggest. Note the input Tags label this 'Information Disclosure,' which conflicts with the CVSS vector (C:N, A:H) - this is a crash/DoS, not a disclosure.

A user is induced to run an X11 application (X client) that connects to an attacker-operated or compromised X server, e.g. over a forwarded/remote display session. The malicious server returns crafted XI2 device-class data that triggers the out-of-bounds read in size_classes()/copy_classes() during parsing, crashing the client application. No public exploit code is identified at time of analysis; impact is limited to termination of the client process.