CVE-2026-109090

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109090", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-10-12T06:41:23.778Z", "datePublished": "2026-10-27T16:32:56.867Z", "dateUpdated": "2026-11-04T20:24:18.063Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-27T16:32:56.867Z"}, "title": "libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow", "datePublic": "2026-10-27T16:28:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-251", "descriptions": [{"lang": "en", "value": "CAPEC-251 Local Code Inclusion"}]}], "affected": [{"vendor": "x.org", "product": "libXi", "packageName": "libXi", "versions": [{"status": "affected", "version": "0", "lessThan": "1.8.4", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:x.org:libxi:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "1.8.4"}]}]}], "descriptions": [{"lang": "en", "value": "A malicious X server could cause a heap overflow by injecting a large\u00a0DEVICE_ENABLE reply when processed by libXi before 1.8.4.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A malicious X server could cause a heap overflow by injecting a large&nbsp;<span>DEVICE_ENABLE reply when processed by libXi before 1.8.4.&nbsp;</span>"}]}], "references": [{"url": "https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b6", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Adam Bedard", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T20:06:06.408932Z", "id": "CVE-2026-109090", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T20:24:18.063Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-109090", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-04T20:06:06.408932Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T20:06:07.152Z"}}], "cna": {"title": "libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Adam Bedard"}], "impacts": [{"capecId": "CAPEC-251", "descriptions": [{"lang": "en", "value": "CAPEC-251 Local Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "x.org", "product": "libXi", "versions": [{"status": "affected", "version": "0", "lessThan": "1.8.4", "versionType": "rpm"}], "packageName": "libXi", "defaultStatus": "unaffected"}], "datePublic": "2026-10-27T16:28:00.000Z", "references": [{"url": "https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b6", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A malicious X server could cause a heap overflow by injecting a large\u00a0DEVICE_ENABLE reply when processed by libXi before 1.8.4.", "supportingMedia": [{"type": "text/html", "value": "A malicious X server could cause a heap overflow by injecting a large&nbsp;<span>DEVICE_ENABLE reply when processed by libXi before 1.8.4.&nbsp;</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:x.org:libxi:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.8.4", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-27T16:32:56.867Z"}}}, "cveMetadata": {"cveId": "CVE-2026-109090", "state": "PUBLISHED", "dateUpdated": "2026-11-04T20:24:18.063Z", "dateReserved": "2026-10-12T06:41:23.778Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-10-27T16:32:56.867Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "libXi", "product": "libXi", "vendor": "x.org", "versions": [{"lessThan": "1.8.4", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "meissner@suse.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A malicious X server could cause a heap overflow by injecting a large\u00a0DEVICE_ENABLE reply when processed by libXi before 1.8.4."}], "id": "CVE-2026-109090", "lastModified": "2026-11-04T21:17:47.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "meissner@suse.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-109090", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T20:06:06.408932Z", "version": "2.0.3"}}]}, "published": "2026-10-27T17:16:57.930", "references": [{"source": "meissner@suse.de", "url": "https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b6"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{"bugzilla": {"description": "libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply", "id": "2562069", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562069"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in libXi. A malicious X server can send an oversized DEVICE_ENABLE response to a connecting client application, triggering a heap-based buffer overflow. This memory corruption can allow arbitrary code execution in the context of the client application or cause it to crash, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-109090", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "libXi", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "libXi", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "libXi", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "libXi", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "libXi", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libXi", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-27T16:32:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-109090\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109090\nhttps://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b6"], "statement": "This vulnerability is rated as Important severity because successful exploitation allows an untrusted display service to execute code with the permissions of the connecting user process or induce an immediate application crash. In standard Red Hat Enterprise Linux environments, desktop and terminal applications interact solely with trusted, locally managed X11 or Xwayland display servers, which substantially limits practical attack exposure. The elevated risk is primarily present when client programs are configured to communicate with remote or unverified display servers across a network.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.8.4)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "libXi", "source": "cna", "vendor": "x.org"}, "product": "libxi", "vendor": "x.org"}], "created": "2026-10-27T17:30:07.277119+00:00", "updated": "2026-11-02T14:00:08.965328+00:00", "vendors": ["x.org", "x.org$PRODUCT$libxi"]}