libXi CVE-2026-93543

Requires the victim X client (linked against libXi before 1.8.4) to establish an X protocol connection to an attacker-controlled or compromised X server, which then sends malformed XI2 device-class data to the client's XI2 class parser. The exploitation is gated by that trust inversion: the X server, normally trusted, must be malicious, and the client must connect to it (UI:R). Impact is limited to crashing the single attached client (availability only) - there is no memory disclosure to the attacker, no integrity impact, and no code execution.

This is a lower-priority issue than the 7.4 CVSS base score suggests, because the only technical impact is a client-side crash. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) explicitly sets C:N and I:N - there is no confidentiality or integrity impact and no code execution; impact is availability-only (A:H), i.e. a denial of service against a single X client process. Critically, the threat model is inverted from normal X11 assumptions: the attacker must be a MALICIOUS or compromised X SERVER, and the victim is an X client that connects to it (UI:R). No EPSS score, KEV listing, or POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. One conflict to verify: the input marks S:C (scope changed), but the practical effect is that libXi crashes its own hosting client process (same security authority), which argues for S:U - I assess S:U, reducing the realistic base score to ~6.5. The 'Information Disclosure' tag also conflicts with the C:N metric; despite the CWE-125 (out-of-bounds READ) class, the disclosed outcome per both the description and vector is a crash, not data leakage.

A user is induced to run or point an X client (built against libXi <1.8.4) at an attacker-controlled or compromised X server - for example via a hostile remote DISPLAY, a malicious X11-forwarding endpoint, or a rogue display server. The malicious server returns crafted XI2 device-class data that the client's XI2 class parser reads past its buffer bounds, crashing the client. No public exploit code is identified in the provided intelligence.