High severity · published Oct 27, 2026
CVE-2026-109090
libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
New
7.5
CVSS
–
EPSS
No
On KEV
Description
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libXi · x.org
before 1.8.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109090
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109090
gitlab.freedesktop.org
https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b6
More from libXi
7.5
CVE-2026-109089
libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow
7.5
CVE-2016-7946
X.org libXi before 1.7.7 allows remote X servers to cause a denial of service (infinite loop) via vectors involving length fields
7.5
CVE-2016-7945
Multiple integer overflows in X.org libXi before 1.7.7 allow remote X servers to cause a denial of service (out-of-bounds memory access or infinite loop) via vectors involving…
7.4
CVE-2026-93543
Out-of-bounds read in libXi's XI2 class parser
6.5
CVE-2026-94281
Out-of-bounds read in libXi's XListInputDevices() class parsing