CVE-2026-94282

A flaw was found in libXi. A malicious or compromised X server can trigger a client-side Denial of Service (DoS) or limited information disclosure by sending crafted event messages. When processing X Input Extension (XI2) enter, leave, or focus events, the library does not validate that the reported button data length fits within the received event payload before copying it into memory. This missing boundary check results in an out-of-bounds read that can crash the client application or expose adjacent in-process memory.

This vulnerability is rated as Moderate severity because exploitation requires a client application to connect to an untrusted or compromised X server, which constrains the attack surface to the local user session. In standard Red Hat Enterprise Linux deployments, applications connect exclusively to trusted local display servers, making remote or unauthorized trigger conditions uncommon. The flaw results primarily in client-side application crashes or limited adjacent memory disclosure, without enabling arbitrary code execution or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.