CVE-2026-94282: X.org Libxi

Medium severity, CVSS 5.6. EPSS: 0.1% chance of exploitation in the next 30 days.

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.

Affected products

• X.org Libxi: before 1.8.4 (fixed in 1.8.4)

Published 2026-09-28. Last modified 2026-09-30.