An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an… (CVE-2026-94282)

CVE-2026-94282 describes an out-of-bounds read in the XI2 enter/leave/focus cookie conversion functionality of libXi versions prior to 1.8.4. This vulnerability allows a malicious X server to cause a crash in an attached X client by triggering the out-of-bounds read, resulting in a denial of service condition. The issue affects multiple specific versions of libXi as listed, and the CVSS 3.1 vector indicates the attack requires local access with low complexity and user interaction, impacting availability with no confidentiality or integrity loss.

The primary impact is a denial of service caused by crashing the X client connected to a malicious X server. There is no indication of confidentiality or integrity compromise. The attack requires local access and user interaction, limiting the attack surface to some extent.

A fix is available in libXi version 1.8.4 and later. Users and administrators should upgrade to libXi 1.8.4 or newer to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or if the issue is already mitigated in certain environments.