Red Hat Patches Out of Bounds Read Flaw in libXi on Enterprise Linux 8
Red Hat published errata RHSA-2026:91268 on 27 October 2026, a security update for libXi, the X.Org X11 XInput runtime library shipped with Red Hat Enterprise Linux 8. The advisory addresses a single issue, CVE-2026-93543, described as a denial of service caused by an out-of-bounds read in the XI2 class parser. Red Hat Product Security rated the security impact as Moderate. The affected footprint covers Red Hat Enterprise Linux 8 on x86_64, IBM z Systems (s390x), Power little endian (ppc64le) and ARM 64 (aarch64), together with the Extended Life Cycle Support 8.10 variants of all four architectures. The issue is tracked internally as Bugzilla 2540529.
Red Hat has not published exploitation details for this flaw beyond the vulnerability class, and no CVSS base score is reproduced in the errata text itself — the advisory directs readers to the CVE page for scoring and acknowledgements. What the advisory does state is the component and the defect type: the XI2 class parser inside libXi reads beyond the bounds of an allocated buffer, with denial of service as the stated consequence. libXi is a client-side library used by applications that consume X Input Extension device data, so the exposure sits with graphical clients rather than with an inbound network service. Fixed packages are available as libXi-1.7.10-2.el8_10, shipped as the source RPM libXi-1.7.10-2.el8_10.src.rpm along with binary, devel, debuginfo and debugsource packages for each supported architecture.
libXi is a low-level dependency rather than something administrators deliberately install, which is where the practical exposure lies: it is pulled in by desktop environments, remote graphical session tooling, VDI images and jump hosts that carry graphical administration utilities, so an organisation can be affected without any deliberate decision to run X11. The realistic worst case described by the vendor is availability loss — a crash of the affected client process — rather than code execution, data disclosure or privilege escalation, which is consistent with the Moderate rating. On current exploitation status, FIRST EPSS places CVE-2026-93543 at a 0.3% probability of exploitation in the next 30 days, and neither the advisory nor the verified evidence available to us records any in-the-wild activity. The inclusion of Extended Life Cycle Support 8.10 channels is worth noting for estates still running older RHEL 8 minor releases under extended support contracts, since those hosts are frequently outside normal patch cadence and tend to accumulate unresolved package-level findings during audits.
Attack Surface
Endpoint OS, Server OS
Tactics
Impact
Techniques
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Apply the fixed package libXi-1.7.10-2.el8_10 from RHSA-2026:91268 on all Red Hat Enterprise Linux 8 and Extended Life Cycle Support 8.10 hosts using 'dnf update libXi libXi-devel', covering x86_64, s390x, ppc64le and aarch64 builds.
- Inventory exposure first with 'rpm -q libXi libXi-devel' or an equivalent Satellite/Ansible fact gather; any version below 1.7.10-2.el8_10 on RHEL 8 is affected by CVE-2026-93543.
- Use the Red Hat Insights patch analysis view referenced in RHSA-2026:91268 to enumerate registered systems affected by this errata rather than scanning the estate manually.
- After updating, identify processes still mapping the old shared object with 'lsof /usr/lib64/libXi.so.6' or 'dnf needs-restarting -r', and restart affected graphical sessions and X11 client applications so the patched library is actually loaded.
- Remove libXi and libXi-devel from production server and container images that run no graphical workload ('dnf remove libXi-devel'), since the library is frequently pulled in as a transitive desktop dependency rather than by design.
- Set 'X11Forwarding no' in /etc/ssh/sshd_config on RHEL 8 servers that do not require forwarded graphical sessions and reload sshd, limiting situations where a local X Input client parses device class data from an untrusted X server.
- Alert on repeated segmentation faults referencing libXi.so.6 in journald or ABRT output ('journalctl -k | grep -i libXi' and /var/spool/abrt), as crashes of X Input clients are the stated impact of this out-of-bounds read.
