CVE-2026-94282CWE-125

CVE-2026-94282

Medium · published September 28, 2026

CVSS v3.1
5.6
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00131 · 2.4th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-09-28T13:17Z
References (1)
https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=cecf160e9731fe01f3632f875f29ffcb598b052a · [email protected]
EPSS history
Timeline
  • 29 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 28 SEP 08:18Z
    Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion
    cvelistv5