CVE-2026-109090 is a heap overflow vulnerability in libXi versions before 1.8.4. It occurs when a malicious X server sends an excessively large DEVICE_ENABLE reply, which is improperly handled by libXi. This flaw can lead to high impact on confidentiality, integrity, and availability.