Threats affecting pkg:deb/x.org/libxi

A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.

CVE-2026-94282 is an out-of-bounds read vulnerability in the libXi library of x.org, specifically affecting versions before 1.8.4. The flaw occurs in the XI2 enter/leave/focus cookie conversion code and could be exploited by a malicious X server to crash an attached X client. This vulnerability has a medium severity rating with a CVSS score of 5.6.

An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client.

An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a