CVE-2016-7946
HighSummary
LibXi versions before 1.7.7 allow remote X servers to cause a denial of service via an infinite loop involving length fields.
Risk Assessment
An attacker can cause service disruptions for applications using libXi, potentially impacting organizational operations.
Recommendation
It is recommended to update libXi to version 1.7.7 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in libXi
See all- CVE-2026-109090High
In libXi before 1.8.4, a malicious X server can cause a heap overflow by injecting a large DEVICE_ENABLE reply. This may lead to a crash or potential code execution.
- CVE-2026-109089High
A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.
- CVE-2026-94282Medium
An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion before 1.8.4 could be used by malicious X server to crash an attached X client.
- CVE-2026-94281Medium
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
- CVE-2026-93545Medium
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
- CVE-2026-93544Medium
An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.
- CVE-2026-93543High
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
- CVE-2026-93542Medium
An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicious servers to crash the X client.
- CVE-2026-93541Medium
An out-of-bounds read in libXi's XQueryDeviceState() before version 1.8.4 could be exploited by an attacker. The description is incomplete, but the vulnerability may lead to information disclosure or a crash.
Original NVD description (English source)
X.org libXi before 1.7.7 allows remote X servers to cause a denial of service (infinite loop) via vectors involving length fields.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS