Azure Linux libXi: a fixed package for two client-library flaws

November 4, 2026

A client library can become an execution path when it trusts a hostile display server. Check whether libXi is installed—and which applications actually use it.

Changed November 4, 2026: Microsoft’s CVRF records now name libXi 1.8.4-1 as the fixed Azure Linux package for CVE-2026-109089 (revision 2.0, 01:45:00 UTC) and CVE-2026-109090 (revision 2.0, 01:45:05 UTC). The fixed-build fields were blank at the previous check. Microsoft first published these mappings on October 29; the vendor-authored CNA disclosures are dated October 27.

Applicability and fix

Microsoft lists azl3 libXi 1.8.1-1 on Azure Linux 3.0 for both flaws. The SUSE-authored CNA records describe upstream libXi before 1.8.4 as affected. CVE-2026-109089 mishandles a DEVICE_RESOLUTION reply; CVE-2026-109090 mishandles an oversized DEVICE_ENABLE reply. A malicious X server can trigger heap corruption in the client. Microsoft and the CNA rate both Important / High, CVSS 3.1 7.5, with network attack vector, high complexity, no privileges and required user interaction.

Use 1.8.4-1 as the Microsoft fixed-build target for this Azure Linux mapping, or a later supported build confirmed to contain the fixes. Microsoft links general Azure Linux upgrade guidance; the per-CVE download URL remains blank. An exact AKS node-image release containing this package was not verified. Do not substitute another distribution’s RPM or infer that all Azure nodes, Windows endpoints or Microsoft-managed services use the vulnerable library.

MSP action

Suggested priority: prompt, elevated where applications connect to untrusted X servers. Inventory Azure Linux 3.0 hosts, containers and desktop or forwarded-X applications for the listed libXi package and actual library use → as a precaution, suspend connections to untrusted display servers where exposure is confirmed → deploy the supported Azure Linux package/image update containing 1.8.4-1; rebuild applicable application images and restart processes still loading the old library → verify installed package and loaded library versions, confirm the image rolled out, and test the affected applications. A package installation alone does not refresh a library already loaded by a process.

Exploitation and limits

Neither CVE appears in the full CISA KEV catalog 2026.11.03, 1,767 records, retrieved November 4. No confirmed active-exploitation statement was verified in the reviewed official material. Microsoft’s records lack a usable exploitation-status field; an omitted field does not establish absence of exploitation. No KEV federal deadline applies. No complete vendor workaround, mandatory compromise check or credential rotation was verified; the connection restriction above is an MSP precaution. Customer use, exposure and compromise are not assumed.