{"id":"OESA-2026-4289","summary":"libXi security update","details":"libXi is the client-side library for the X Input Extension.\r\n\r\nSecurity Fix(es):\n\nAn out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a(CVE-2026-93541)\n\nAn out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client.(CVE-2026-93542)\n\nAn out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.(CVE-2026-93543)\n\nAn out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.(CVE-2026-93544)\n\nAn out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.(CVE-2026-93545)\n\nAn out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.(CVE-2026-94281)\n\nAn out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.(CVE-2026-94282)","modified":"2026-10-16T12:15:07.178393227Z","published":"2026-10-16T11:58:59Z","upstream":["CVE-2026-93541","CVE-2026-93542","CVE-2026-93543","CVE-2026-93544","CVE-2026-93545","CVE-2026-94281","CVE-2026-94282"],"database_specific":{"severity":"High"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4289"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93541"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93542"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93543"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93544"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93545"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94281"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94282"}],"affected":[{"package":{"name":"libXi","ecosystem":"openEuler:24.03-LTS-SP1","purl":"pkg:rpm/openEuler/libXi&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-4.oe2403sp1"}]}],"ecosystem_specific":{"noarch":["libXi-help-1.8.1-4.oe2403sp1.noarch.rpm"],"src":["libXi-1.8.1-4.oe2403sp1.src.rpm"],"x86_64":["libXi-1.8.1-4.oe2403sp1.x86_64.rpm","libXi-debuginfo-1.8.1-4.oe2403sp1.x86_64.rpm","libXi-debugsource-1.8.1-4.oe2403sp1.x86_64.rpm","libXi-devel-1.8.1-4.oe2403sp1.x86_64.rpm"],"aarch64":["libXi-1.8.1-4.oe2403sp1.aarch64.rpm","libXi-debuginfo-1.8.1-4.oe2403sp1.aarch64.rpm","libXi-debugsource-1.8.1-4.oe2403sp1.aarch64.rpm","libXi-devel-1.8.1-4.oe2403sp1.aarch64.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-4289.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H"}]}