There are 7 open security issues in trixie.
7 issues left for the package maintainer to handle:
- CVE-2026-93541:
(needs triaging)
An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a
- CVE-2026-93542:
(needs triaging)
An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client.
- CVE-2026-93543:
(needs triaging)
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
- CVE-2026-93544:
(needs triaging)
An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.
- CVE-2026-93545:
(needs triaging)
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
- CVE-2026-94281:
(needs triaging)
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
- CVE-2026-94282:
(needs triaging)
An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.
You can find information about how to handle these issues in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/libx/libxi.png){kind=link}