libXi EUVD-2026-86275

Exploitation requires the victim's X client to communicate with an attacker-controlled or compromised X SERVER (the trust direction is reversed from typical client bugs) and to issue an XI2 XIQueryDevice request via libXi before 1.8.4. This is most realistic under untrusted X11 forwarding (e.g., 'ssh -X' to a hostile host), connections to a rogue display, or a man-in-the-middle on the X protocol stream. Limiting factors: the attacker must control the server side and induce/observe the client connection (UI:R), and the maximum impact is a crash of the single affected client process - no privilege gain, code execution, or data leakage. Systems using only a trusted local X server are not realistically exposed.

This is a denial-of-service issue, not a code-execution or disclosure flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5 MEDIUM) is internally consistent with the description: an out-of-bounds read in libXi's XI2 XIQueryDevice reply parser lets a MALICIOUS X SERVER crash an attached client - pure availability impact (A:H), no confidentiality or integrity effect (C:N/I:N). The inverted trust direction is important: the attacker is the server and the victim is the client, so UI:R reflects that a user/client must connect to (or be redirected to) the attacker-controlled server. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. Realistically this is a low-urgency, patch-in-normal-cycle item: worst case is a client process crash, and the precondition (connecting to a hostile X server) is uncommon outside of untrusted X-forwarding / remote-display scenarios. Note the input Tags include 'Information Disclosure,' which conflicts with the C:N in the CVSS vector - the described impact is a crash only, not data leakage.

A victim's X client (e.g., over untrusted SSH X11 forwarding or connecting to an attacker-controlled display) links against libXi and issues an XIQueryDevice request. The malicious X server returns a crafted XI2 reply whose declared structure exceeds the actual buffer, triggering the out-of-bounds read in libXi and crashing the client. No public exploit code was identified in the provided data.