CVE-2026-94287
MediumCVSS 5.5Summary
A denial of service via unsigned underflow in libXpm's write path before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.
Risk Assessment
A local attacker may cause system overload, leading to unavailability of services or system crash.
Recommendation
Update libXpm to version 3.5.19 or later to fix the vulnerability.
Other vulnerabilities in libXpm
See all- CVE-2016-10164Critical
Multiple integer overflows in libXpm before version 3.5.12 can lead to remote denial of service or arbitrary code execution. The issue occurs when a program requests parsing XPM extensions on a 64-bit platform, potentially causing a heap-based buffer overflow.
- CVE-2026-4367Medium
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
Original NVD description (English source)
A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS