{"id":"MGASA-2026-0526","summary":"Updated libxi package fixes security vulnerabilities","details":"Out-of-bounds read in libXi's XQueryDeviceState(). (CVE-2026-93541)\nOut-of-bounds read in libXi's XI2 class parsing via size_classes() and\ncopy_classes(). (CVE-2026-93542)\nOut-of-bounds read in libXi's XI2 class parser. (CVE-2026-93543)\nOut-of-bounds read in libXi's XI2 XIQueryDevice reply parsing.\n(CVE-2026-93544)\nOut-of-bounds read in libXi's XListInputDevices(). (CVE-2026-93545)\nOut-of-bounds read in libXi's XListInputDevices() class parsing.\n(CVE-2026-94281)\nOut-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion.\n(CVE-2026-94282)\n","modified":"2026-10-20T02:43:23.650506610Z","published":"2026-10-20T02:38:36Z","upstream":["CVE-2026-93541","CVE-2026-93542","CVE-2026-93543","CVE-2026-93544","CVE-2026-93545","CVE-2026-94281","CVE-2026-94282"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0526.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=36449"},{"type":"WEB","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2JXZPB52ROWMGP2VLGNYLYMGSTZQNEIA/"}],"affected":[{"package":{"name":"libxi","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/libxi?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-2.1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0526.json"}}],"schema_version":"1.9.0","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}