An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. (CVE-2026-93543)

CVE-2026-93543 describes an out-of-bounds read in the XI2 class parser component of libXi versions prior to 1.8.4. This vulnerability can be exploited by a malicious X server to cause a crash in an attached X client, resulting in denial of service. The vulnerability affects multiple specific versions of libXi as listed. There is no indication of confidentiality or integrity impact, and no known exploits are reported in the wild. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality or integrity impact, and high impact on availability.

The primary impact is denial of service due to a crash of the X client when interacting with a malicious X server exploiting the out-of-bounds read. There is no impact on confidentiality or integrity. No known active exploitation has been reported.

A fix is available in libXi version 1.8.4 and later. Users and administrators should upgrade to libXi 1.8.4 or newer to remediate this vulnerability. No other mitigation guidance is provided or necessary based on the available data.