CVE-2026-109089

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109089", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-10-12T06:41:23.778Z", "datePublished": "2026-10-27T16:05:56.113Z", "dateUpdated": "2026-11-04T20:25:34.559Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-27T16:05:56.113Z"}, "title": "libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow", "datePublic": "2026-10-27T16:01:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-549", "descriptions": [{"lang": "en", "value": "CAPEC-549 Local Execution of Code"}]}], "affected": [{"vendor": "X.Org", "product": "libXi", "packageName": "libXi", "repo": "https://gitlab.freedesktop.org/xorg/lib/libxi", "versions": [{"status": "affected", "version": "0", "lessThan": "1.8.4", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.</p><br>"}]}], "references": [{"url": "https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f7836d0a0", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Adam Bedard", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T18:46:08.623971Z", "id": "CVE-2026-109089", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T20:25:34.559Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-109089", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-04T18:46:08.623971Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T18:46:09.322Z"}}], "cna": {"title": "libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Adam Bedard"}], "impacts": [{"capecId": "CAPEC-549", "descriptions": [{"lang": "en", "value": "CAPEC-549 Local Execution of Code"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://gitlab.freedesktop.org/xorg/lib/libxi", "vendor": "X.Org", "product": "libXi", "versions": [{"status": "affected", "version": "0", "lessThan": "1.8.4", "versionType": "rpm"}], "packageName": "libXi", "defaultStatus": "unaffected"}], "datePublic": "2026-10-27T16:01:00.000Z", "references": [{"url": "https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f7836d0a0", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.", "supportingMedia": [{"type": "text/html", "value": "<p>A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-27T16:05:56.113Z"}}}, "cveMetadata": {"cveId": "CVE-2026-109089", "state": "PUBLISHED", "dateUpdated": "2026-11-04T20:25:34.559Z", "dateReserved": "2026-10-12T06:41:23.778Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-10-27T16:05:56.113Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "libXi", "product": "libXi", "repo": "https://gitlab.freedesktop.org/xorg/lib/libxi", "vendor": "X.Org", "versions": [{"lessThan": "1.8.4", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "meissner@suse.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server."}], "id": "CVE-2026-109089", "lastModified": "2026-11-04T21:17:47.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "meissner@suse.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-109089", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T18:46:08.623971Z", "version": "2.0.3"}}]}, "published": "2026-10-27T17:16:57.810", "references": [{"source": "meissner@suse.de", "url": "https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f7836d0a0"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{"bugzilla": {"description": "libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow", "id": "2562191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562191"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in libXi. A heap-based buffer overflow vulnerability occurs when the library processes DEVICE_RESOLUTION data received from an X Window System server. A malicious or compromised X server can send crafted responses to a connecting client application, potentially leading to arbitrary code execution or causing a Denial of Service (DoS) through an application crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-109089", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "libXi", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "libXi", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "libXi", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "libXi", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "libXi", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libXi", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-27T16:05:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-109089\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109089\nhttps://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f7836d0a0"], "statement": "This vulnerability is rated as Important because malicious responses from an X server could cause memory corruption, potentially allowing arbitrary code execution within the privileges of the client application. On Red Hat Enterprise Linux systems, graphical applications typically communicate only with trusted, local display servers managed by the OS. Exploiting this condition requires a user or client program to explicitly connect to an untrusted or compromised external display server, which limits exposure in standard operational configurations.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.8.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "libXi", "source": "cna", "vendor": "X.Org"}, "product": "libxi", "vendor": "x.org"}], "created": "2026-10-27T17:45:06.457849+00:00", "updated": "2026-11-02T14:45:18.367200+00:00", "vendors": ["x.org", "x.org$PRODUCT$libxi"]}