Advisories » MGASA-2026-0526

Updated libxi package fixes security vulnerabilities

Publication date: 20 Oct 2026
Modification date: 20 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-93541 , CVE-2026-93542 , CVE-2026-93543 , CVE-2026-93544 , CVE-2026-93545 , CVE-2026-94281 , CVE-2026-94282

Description

Out-of-bounds read in libXi's XQueryDeviceState(). (CVE-2026-93541)
Out-of-bounds read in libXi's XI2 class parsing via size_classes() and
copy_classes(). (CVE-2026-93542)
Out-of-bounds read in libXi's XI2 class parser. (CVE-2026-93543)
Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing.
(CVE-2026-93544)
Out-of-bounds read in libXi's XListInputDevices(). (CVE-2026-93545)
Out-of-bounds read in libXi's XListInputDevices() class parsing.
(CVE-2026-94281)
Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion.
(CVE-2026-94282)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36449
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2JXZPB52ROWMGP2VLGNYLYMGSTZQNEIA/
• https://www.cve.org/CVERecord?id=CVE-2026-93541
• https://www.cve.org/CVERecord?id=CVE-2026-93542
• https://www.cve.org/CVERecord?id=CVE-2026-93543
• https://www.cve.org/CVERecord?id=CVE-2026-93544
• https://www.cve.org/CVERecord?id=CVE-2026-93545
• https://www.cve.org/CVERecord?id=CVE-2026-94281
• https://www.cve.org/CVERecord?id=CVE-2026-94282

SRPMS

10/core

• libxi-1.8.2-2.1.mga10