libXi EUVD-2026-86278

Requires that a victim X client using libXi (before 1.8.4) connect to an attacker-controlled or malicious X server and invoke XListInputDevices(); the hostile server then returns a crafted reply triggering the out-of-bounds read. This maps to UI:R - a user or application must initiate the connection to the malicious display. Limiting factors: the trust model is inverted (server attacks client), so it is only realistic where clients reach untrusted X servers, e.g. X11-forwarding over SSH to untrusted hosts or exposed/remote X displays; impact is confined to crashing the client process (no RCE, no data disclosure). Standard local desktop sessions connecting only to a trusted local server are effectively not exposed.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) describes a purely availability-impacting flaw: an out-of-bounds read in libXi's XListInputDevices() that lets a malicious X server crash a connecting X client. Note the inverted trust model - the 'attacker' is the X server and the 'victim' is the client library, so exploitation requires that a client be induced to connect to an attacker-controlled X display (reflected in UI:R). There is no confidentiality or integrity impact (C:N/I:N), only denial of service (A:H), so despite the network attack vector this is not a code-execution or data-disclosure issue. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. Overall this is a moderate, DoS-only bug: real but low-urgency, because the realistic threat requires a user/application to be tricked into pointing its X client at a hostile server (uncommon on locked-down desktops, more plausible over SSH X11-forwarding or exposed X displays). Signals are internally consistent (crash-only impact matches A:H/C:N/I:N); the main nuance to verify is the atypical server-attacks-client direction.

An attacker stands up a malicious X server (or hijacks an X11-forwarding/display endpoint) and induces a victim to run an X client - e.g. any application calling XListInputDevices() - against it. The malicious server returns a crafted reply that triggers the out-of-bounds read in libXi, crashing the client application. No public exploit code is identified, and the impact is limited to client denial of service (no code execution or data theft).