CVE-2026-4367 Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing
MediumCVSS 5.5
EPSS 0.13%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord() function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat hummingbird | < 3.5.17-7.2.hum1 | 3.5.17-7.2.hum1 |
| redhat hummingbird | < 3.5.19-4.hum1 | 3.5.19-4.hum1 |
| redhat enterprise linux | All versions | No fix listed |
| redhat rhel els | All versions | No fix listed |
| debian/libxpm(Debian:12) | All versions | No fix listed |
| debian/libxpm(Debian:12) | = 1:3.5.12-1.1 | No fix listed |
| debian/libxpm(Debian:12) | = 1:3.5.12-1.1+deb12u1 | No fix listed |
| debian/libxpm(Debian:12) | = 1:3.5.17-1 | No fix listed |
| debian/libxpm(Debian:12) | = 1:3.5.19-1 | No fix listed |
| debian/libxpm(Debian:12) | = 1:3.5.20-1 | No fix listed |
| debian/libxpm(Debian:13) | < 1:3.5.17-1+deb13u1 | 1:3.5.17-1+deb13u1 |
| debian/libxpm(Debian:13) | = 1:3.5.17-1 | No fix listed |
| debian/libxpm(Debian:14) | < 1:3.5.19-1 | 1:3.5.19-1 |
| debian/libxpm(Debian:14) | = 1:3.5.17-1 | No fix listed |
| redhat/libxpm-main(Red Hat:hummingbird:1) | < 3.5.17-7.2.hum1 | 3.5.17-7.2.hum1 |
| redhat/libxpm-main(Red Hat:hummingbird:1) | < 3.5.19-4.hum1 | 3.5.19-4.hum1 |
| redhat/libXpm(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/libXpm(Red Hat:rhel_els:6) | All versions | No fix listed |
| redhat/libXpm(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/libXpm(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/libXpm(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| ubuntu/libxpm(Ubuntu:22.04) | < 1:3.5.12-1ubuntu0.22.04.3 | 1:3.5.12-1ubuntu0.22.04.3 |
| ubuntu/motif(Ubuntu:22.04) | All versions | No fix listed |
| alpine/libxpm(Alpine:v3.20) | < 3.5.19-r0 | 3.5.19-r0 |
| alpine/libxpm(Alpine:v3.21) | < 3.5.19-r0 | 3.5.19-r0 |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/libxpm(Alpine:v3.22) | < 3.5.19-r0 | 3.5.19-r0 |
| alpine/libxpm(Alpine:v3.23) | < 3.5.19-r0 | 3.5.19-r0 |
| alpine/libxpm(Alpine:v3.24) | < 3.5.19-r0 | 3.5.19-r0 |
| ubuntu/libxpm(Ubuntu:24.04) | < 1:3.5.17-1ubuntu0.24.04.1 | 1:3.5.17-1ubuntu0.24.04.1 |
| ubuntu/motif(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libxpm(Ubuntu:26.04) | < 1:3.5.17-1ubuntu0.26.04.1 | 1:3.5.17-1ubuntu0.26.04.1 |
| ubuntu/motif(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/motif(Ubuntu:26.10) | All versions | No fix listed |
| azure linux libXpm(Azure Linux:3.0) | < 3.5.19-1 | 3.5.19-1 |
References
- MSRC Security Update Guide vendor-advisory
- CBL-Mariner Releases vendor-advisory
- RHSA-2026:30354 patch vendor-advisory
- RHSA-2026:47072 patch vendor-advisory
- Red Hat CVE page mitigation vdb-entry vendor-advisory
- RHBZ#2448984 issue-tracking
- gitlab.freedesktop.org
- seclists.org
- www.openwall.com
- Debian Security Tracker CVE-2026-4367 vendor-advisory
- www.cve.org
- nvd.nist.gov
- Ubuntu CVE tracker vendor-advisory
- USN-8600-1 vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking