The Red Hat security advisory RHSA-2026:71839 addresses several vulnerabilities in the libXi package used in Red Hat Hardened Images. Notably, CVE-2026-93541 is an out-of-bounds read vulnerability in the XQueryDeviceState() function, which allows a malicious X server to cause a client application to read memory beyond allocated buffer boundaries, leading to a crash (DoS). The advisory provides updated RPMs (libXi-1.8.3-2.1.hum1 and libXi-devel-1.8.3-2.1.hum1) for aarch64 and x86_64 architectures. Red Hat has assigned a CVSS v3 base score of 6.5 (medium severity) for CVE-2026-93541, reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact. No effective mitigations are available that meet Red Hat's criteria for ease of use and deployment. The advisory references the upstream fix and provides links for further details.

The vulnerability allows a malicious X server to trigger an out-of-bounds read in client applications using libXi, causing them to crash and resulting in a denial of service. There is no confidentiality or integrity impact reported. The issue could potentially expose memory contents that might aid in bypassing protection mechanisms, but the primary impact is availability due to application crashes.

A fixed update is available in the form of libXi-1.8.3-2.1.hum1 and libXi-devel-1.8.3-2.1.hum1 RPMs for affected architectures. Users should apply this update to remediate the vulnerabilities. No other mitigations meeting Red Hat's criteria for ease of use and deployment are currently available. Refer to the Red Hat advisory RHSA-2026:71839 for detailed update instructions.