CVE-2026-109090

What it actually does

Heap overflow triggered when libXi processes an oversized DEVICE_ENABLE reply sent by a malicious X server, allowing out-of-bounds writes in memory.

Why it matters to the business

Applications relying on the X Input extension may crash or allow remote code execution, potentially disrupting user sessions and requiring emergency patching across client systems.

How an attack unfolds

An attacker positions a malicious X server that responds to DEVICE_ENABLE queries with an excessively large reply; when a vulnerable libXi client connects and processes the reply, the heap overflow occurs, enabling memory corruption that can be leveraged for code execution.

How to fix it

Upgrade libXi to version 1.8.4 or later; rebuild and redeploy any dependent packages that statically link the library.

How to confirm the fix worked

Verify installed libXi version is 1.8.4 or newer via package manager or library inspection; test connectivity against a controlled X server sending large DEVICE_ENABLE replies to confirm no overflow occurs.

Typical attack path

1. Attacker deploys or compromises an X server to send crafted DEVICE_ENABLE replies
2. Target client initiates an X session connecting to the malicious server
3. libXi processes the oversized reply triggering the heap overflow
4. Attacker exploits memory corruption to execute arbitrary code or crash the process

How to detect it

Review X client logs for unexpected connections to untrusted servers and inspect for crashes or memory corruption indicators in processes using the X Input extension shortly after session establishment.

What your security team should do

• Prioritize updating libXi across all systems within 48 hours given the one-day publication window
• Audit X client configurations to restrict connections to trusted X servers only
• Monitor for new exploit code and increase logging on X protocol handling paths