{ "cveId": "CVE-2026-109090", "url": "https://patchblox.com/security/cve/CVE-2026-109090", "summary": "CVE-2026-109090 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2026-109090, released November 3, 2026. It is not reported as exploited. Patch Radar priority: High.", "title": "libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow", "description": "A malicious X server could cause a heap overflow by injecting a large\u00A0DEVICE_ENABLE reply when processed by libXi before 1.8.4.", "published": "2026-10-27T16:32:56Z", "severity": "Important", "cvss": 7.5, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cwe": "Heap-based Buffer Overflow", "epss": 0.00258, "epssPercentile": 0.1758, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109090", "fixes": [ { "platform": "linux", "product": "libXi", "release": "RHEL 10", "fixedVersion": "1.8.1-7.el10_2.3", "fix": "RHSA-2026:93441", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-93441", "released": "2026-11-03T19:00:44Z" }, { "platform": "linux", "product": "libXi", "release": "RHEL 8", "fixedVersion": "0:1.7.10-4.el8_10", "fix": "RHSA-2026:93438", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-93438", "released": "2026-11-03T18:59:02Z" }, { "platform": "linux", "product": "libXi", "release": "RHEL 9", "fixedVersion": "0:1.7.10-8.el9_8.3", "fix": "RHSA-2026:93439", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-93439", "released": "2026-11-03T19:00:44Z" }, { "platform": "linux", "product": "libXi", "release": "almalinux 10", "fixedVersion": "1.8.1-7.el10_2.3", "fix": "ALSA-2026:93441", "url": "https://patchblox.com/security/fix/linux/alsa-2026-93441", "released": "2026-11-07T00:39:57Z" }, { "platform": "linux", "product": "libXi", "release": "almalinux 8", "fixedVersion": "1.7.10-4.el8_10", "fix": "ALSA-2026:93438", "url": "https://patchblox.com/security/fix/linux/alsa-2026-93438", "released": "2026-11-07T00:40:18Z" }, { "platform": "linux", "product": "libXi", "release": "almalinux 9", "fixedVersion": "1.7.10-8.el9_8.3", "fix": "ALSA-2026:93439", "url": "https://patchblox.com/security/fix/linux/alsa-2026-93439", "released": "2026-11-07T00:40:32Z" }, { "platform": "linux", "product": "libXi", "release": "ol 10", "fixedVersion": "0:1.8.1-7.el10_2.3", "fix": "ELSA-2026-93441", "url": "https://patchblox.com/security/fix/linux/elsa-2026-93441", "released": "2026-11-07T00:59:15Z" }, { "platform": "linux", "product": "libXi", "release": "ol 8", "fixedVersion": "0:1.7.10-4.el8_10", "fix": "ELSA-2026-93438", "url": "https://patchblox.com/security/fix/linux/elsa-2026-93438", "released": "2026-11-07T00:48:28Z" }, { "platform": "linux", "product": "libXi", "release": "ol 9", "fixedVersion": "0:1.7.10-8.el9_8.3", "fix": "ELSA-2026-93439", "url": "https://patchblox.com/security/fix/linux/elsa-2026-93439", "released": "2026-11-07T00:52:27Z" }, { "platform": "linux", "product": "libXi", "release": "rocky 10", "fixedVersion": "0:1.8.1-7.el10_2.3", "fix": "RLSA-2026:93441", "url": "https://patchblox.com/security/fix/linux/rlsa-2026-93441", "released": "2026-11-07T00:39:51Z" }, { "platform": "linux", "product": "libXi", "release": "rocky 8", "fixedVersion": "0:1.7.10-4.el8_10", "fix": "RLSA-2026:93438", "url": "https://patchblox.com/security/fix/linux/rlsa-2026-93438", "released": "2026-11-07T00:39:51Z" }, { "platform": "linux", "product": "libXi", "release": "rocky 9", "fixedVersion": "0:1.7.10-8.el9_8.3", "fix": "RLSA-2026:93439", "url": "https://patchblox.com/security/fix/linux/rlsa-2026-93439", "released": "2026-11-07T00:39:57Z" }, { "platform": "linux", "product": "libXi-devel", "release": "RHEL 8", "fixedVersion": "0:1.7.10-4.el8_10", "fix": "RHSA-2026:93438", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-93438", "released": "2026-11-03T18:59:02Z" }, { "platform": "linux", "product": "libXi-devel", "release": "RHEL 9", "fixedVersion": "0:1.7.10-8.el9_8.3", "fix": "RHSA-2026:93439", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-93439", "released": "2026-11-03T19:00:44Z" }, { "platform": "linux", "product": "libXi-devel", "release": "almalinux 10", "fixedVersion": "1.8.1-7.el10_2.3", "fix": "ALSA-2026:93441", "url": "https://patchblox.com/security/fix/linux/alsa-2026-93441", "released": "2026-11-07T00:39:57Z" }, { "platform": "linux", "product": "libXi-devel", "release": "almalinux 8", "fixedVersion": "1.7.10-4.el8_10", "fix": "ALSA-2026:93438", "url": "https://patchblox.com/security/fix/linux/alsa-2026-93438", "released": "2026-11-07T00:40:18Z" }, { "platform": "linux", "product": "libXi-devel", "release": "almalinux 9", "fixedVersion": "1.7.10-8.el9_8.3", "fix": "ALSA-2026:93439", "url": "https://patchblox.com/security/fix/linux/alsa-2026-93439", "released": "2026-11-07T00:40:32Z" }, { "platform": "linux", "product": "libXi-devel", "release": "ol 10", "fixedVersion": "0:1.8.1-7.el10_2.3", "fix": "ELSA-2026-93441", "url": "https://patchblox.com/security/fix/linux/elsa-2026-93441", "released": "2026-11-07T00:59:15Z" }, { "platform": "linux", "product": "libXi-devel", "release": "ol 8", "fixedVersion": "0:1.7.10-4.el8_10", "fix": "ELSA-2026-93438", "url": "https://patchblox.com/security/fix/linux/elsa-2026-93438", "released": "2026-11-07T00:48:28Z" }, { "platform": "linux", "product": "libXi-devel", "release": "ol 9", "fixedVersion": "0:1.7.10-8.el9_8.3", "fix": "ELSA-2026-93439", "url": "https://patchblox.com/security/fix/linux/elsa-2026-93439", "released": "2026-11-07T00:52:27Z" }, { "platform": "linux", "product": "libxi", "release": "Debian 14", "fixedVersion": "2:1.8.4-1", "fix": "DEBIAN-CVE-2026-109090", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-109090", "released": "2026-11-03T18:58:21Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T07:25:28Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }