libXi EUVD-2026-86281

Requires the victim X client to establish a connection to a malicious or compromised X server and to invoke XListInputDevices() (the X Input extension device-enumeration path in libXi before 1.8.4); the hostile server then returns crafted input-device class data. This is an inverted trust model - normally clients trust the server - so exploitation depends on a user or application connecting to an attacker-controlled display (e.g., untrusted X forwarding or a rogue display endpoint), reflected by UI:R. Impact is limited to crashing the client process; there is no code execution, and no confidentiality or integrity effect. Not exploitable against the common case where clients connect only to trusted local servers.

This is a client-side denial-of-service with an inverted trust model: the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) attributes A:H (crash) with C:N/I:N - no confidentiality or integrity impact - despite the CWE-125 out-of-bounds read and the 'Information Disclosure' tag, which overstate the consequence; the described real effect is only that a malicious X server can crash an attached X client. Exploitation requires the victim X client to connect to an attacker-controlled or compromised X server (reflected by UI:R), an atypical and generally deliberate action rather than default operation, so real-world exposure is narrow. No EPSS score, no CISA KEV listing, and no public exploit code are provided (no SSVC data either), so this is: no public exploit identified at time of analysis. Net: a genuine but low-priority DoS - the moderate 6.5 CVSS overstates urgency because impact is availability-only and the attack requires a hostile server the client chooses to connect to.

An attacker stands up or compromises an X server (e.g., a malicious remote display / X-forwarding endpoint) and waits for or lures a victim to connect an X client to it. When the client calls XListInputDevices(), the malicious server returns crafted input-device class data that triggers the out-of-bounds read in libXi's class parser, crashing the client application. No public proof-of-concept is identified; impact is limited to client crash (denial of service) with no code execution or data disclosure.