libXi-1.8.4 (Xorg library)

[Bruce Dubbs]

New point version.

[Joe Locash]

libXi - library for the X Input Extension
-----------------------------------------

This release includes the fixes for the issues listed in
https://lists.x.org/archives/xorg-announce/2026-October/003752.html
as well as additional hardening and bug fixes.

Alan Coopersmith (4):
      Strip trailing whitespace from source files
      Track XIValuatorClass correctly during copyDeviceChangedEvent
      Set num_classes to number of copied classes in copyDeviceChangedEvent
      libXi 1.8.4

Olivier Fourdan (10):
      XQueryDeviceState: check ValuatorClass num_valuators against class length
      size_classes/copy_classes: bound XI2 class lengths to the received buffer
      size_classes/copy_classes: enforce XI2 per-type class payload sizes
      XIQueryDevice: keep padded name and class bytes within the reply
      XListInputDevices: validate device name lengths against reply buffer
      XListInputDevices: validate class lengths cumulatively in SizeClassInfo
      wireToEnterLeave: validate buttons_len against the received event size
      XGetDeviceControl: require reply control to match the request
      XGetDeviceControl: size DEVICE_ENABLE replies for XDeviceEnableState
      XGetDeviceControl: set DEVICE_ENABLE length to the struct size

Peter Hutterer (6):
      wireToEnterLeave: validate the valuator count to avoid OOB writes
      Actually copy the full keycodes in copy_classes
      Fix potential for class size mismatches
      XListInputDevices: make sure we have enough bytes for the info
      Add missing touch and gesture class handling to copyDeviceChangedEvent
      Track unknown classes correctly during copyDeviceChangedEvent

git tag: libXi-1.8.4

From ​https://lists.x.org/archives/xorg-announce/2026-October/003752.html

========================================================================
libXi - 9 CVEs
========================================================================

For those considering cherry-picking the fixes, note that libXi 1.8.4
also includes additional code hardening fixes without CVEs assigned
that you may also want to consider.

* CVE-2026-93541:
  Out-of-bounds read in libXi's XQueryDeviceState().

  XQueryDeviceState() trusts the num_valuators value from a
  ValuatorClass reply without checking it fits in the declared class
  length, enabling an OOB read and client crash via a forged reply.

  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 6.5 (MEDIUM)

  Fixed in: libXi 1.8.4
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/9a5f8636b
  Found by: Aisle Research (AISLE-Report-PSIRTSUPT-13253)

* CVE-2026-93542:
  Out-of-bounds read in libXi's XI2 class parsing via size_classes()
  and copy_classes().

  Malicious XIQueryDevice replies or XI_DeviceChanged events with
  inconsistent class lengths can drive the parser past the received
  buffer and crash the client.

  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 6.5 (MEDIUM)

  Fixed in: libXi 1.8.4
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/59f8dece8
  Found by: Aisle Research (AISLE-Report-PSIRTSUPT-13600)

* CVE-2026-93543:
  Out-of-bounds read in libXi's XI2 class parser.

  A malicious X server can send forged XI_DeviceChanged events
  (or XIQueryDevice replies) with inconsistent class metadata.
  An overlong num_classes, zero or oversized per-class length,
  or button/key counts exceeding the class bytes causing the
  size_classes() and copy_classes() to walk past the event/reply
  buffer and crash the client.

  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 5.9 (MEDIUM)

  Fixed in: libXi 1.8.4
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f885619bb
  Found by: Aisle Research (AISLE-Report-PSIRTSUPT-13717)

* CVE-2026-93544:
  Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing.

  Class parsing helpers size_classes()/copy_classes() and the
  XIQueryDevice() caller walk wire data using data provided by the
  Xserver (length, num_buttons and num_keycodes) without bounds
  checking, enabling OOB reads and client crashes via malformed
  replies.

  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — 6.5 (MEDIUM)

  Fixed in: libXi 1.8.4
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/e2ec4a1c8
  Found by: Aisle Research (AISLE-Report-PSIRTSUPT-14043)

* CVE-2026-93545:
  Out-of-bounds read in libXi's XListInputDevices()

  A malicious server can set a name length byte that exceeds the
  remaining reply bytes, causing memcpy() to read past the buffer
  when parsing device name strings from a ListInputDevices reply.

  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L — 5.4 (MEDIUM)

  Fixed in: libXi 1.8.4
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/2e5ecd187
  Found by: Aisle Research (AISLE-Report-PSIRTSUPT-14711)

* CVE-2026-94281:
  Out-of-bounds read in libXi's XListInputDevices() class parsing.

  SizeClassInfo() validates each class record's length against the
  original buffer size but never decrements it, allowing a sequence
  of individually-valid class lengths to cumulatively advance past
  the buffer. ParseClassInfo() then walks the same records without
  any bounds checking.

  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L — 5.4 (MEDIUM)

  Fixed in: libXi 1.8.4
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/1d5813ba0
  Found by: Aisle Research (AISLE-Report-PSIRTSUPT-14718)

* CVE-2026-94282:
  Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion.

  A malicious X server can send a crafted XI2 Enter, Leave, FocusIn,
  or FocusOut GenericEvent with a small outer length but an oversized
  buttons_len field, causing wireToEnterLeave() to copy data past the
  end of the received event buffer.

  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H — 6.1 (MEDIUM)

  Fixed in: libXi 1.8.4
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/8caed97a3
  Found by: Aisle Research (AISLE-Report-PSIRTSUPT-15083)

* CVE-2026-109089:
  libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow

  XGetDeviceControl() sizes the client buffer from the server's
  d->control and fills it from the caller's control argument. A hostile
  server can answer DEVICE_RESOLUTION with a small fixed-size control
  type so allocation is tiny while the fill still walks an unbounded
  DEVICE_RESOLUTION valuator list, overflowing the heap.

  Fixed in: libXi 1.8.4
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f7836d0a0
  Found by: Adam Bedard, Security Researcher.

* CVE-2026-109090:
  libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow

  DEVICE_ENABLE has a fill path in XGetDeviceControl() but no size arm,
  so allocation uses the wire length (8 bytes) while the fill writes a
  full XDeviceEnableState (12–16 bytes), overflowing the heap.

  Fixed in: libXi 1.8.4
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b6
  Found by: Adam Bedard, Security Researcher.

Fixed at 3c128729d3. Leaving open for SA.

[Bruce Dubbs]

Advisory sa-13.1-075 has been issued. This advisory covers five related Xorg libraries.