CVE-2026-94282

Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion

Medium5.6EPSS 0.13%

Published: 28 Sept 2026
Updated: 30 Sept 2026
Reserved: 21 Sept 2026
Assigned by: suse

Description

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.

Scores

CVSS scores of CVE-2026-94282, by who scored it
Scored by	CVSS	Score	Vector
suseCNA (assigner)	3.1	Medium5.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
NVDNVD · Awaiting Analysis	3.1	Medium5.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

EPSS (exploitation in 30 days): 0.13% · top 98% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.6.

Weakness

CWE-125 Out-of-bounds read (opens in a new tab)All about CWE-125 and its CVEs

Affected products

x.org · libXi
- affected < 1.8.4

References (1)

https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=cecf160e9731fe01f3632f875f29ffcb598b052a (opens in a new tab)patch

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-94282](https://trackcve.app/badge/CVE-2026-94282.svg)](https://trackcve.app/cve/CVE-2026-94282)

Record last updated 30 Sept 2026, 12:41 UTC.