CVE-2026-4367
Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord() function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord() function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
- Record
CVE-2026-4367- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-37136
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord() function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
- Record
EUVD-2026-37136- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c2rx-36v4-qc8g
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read...
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord() function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
- Record
GHSA-c2rx-36v4-qc8g- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord() function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
- Record
CVE-2026-4367- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-4367
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord() function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
- Record
ALPINE-CVE-2026-4367- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2026-4367
- Record
BELL-CVE-2026-4367- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSV
Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord() function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
- Record
CVE-2026-4367- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-4367
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord() function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
- Record
DEBIAN-CVE-2026-4367- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-2151
libXpm security update
X.Org X11 libXpm runtime library
Security Fix(es):
A vulnerability was found in X.org libXpm up to 3.5.4. It has been classified as problematic.CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on confidentiality.Upgrading to version 3.5.19 eliminates this vulnerability. Applying the patch 5448e1bd is able to eliminate this problem. The bugfix is ready for download at gitlab.freedesktop.org. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2026-4367)
- Record
OESA-2026-2151- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:30354
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:30354- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:47072
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:47072- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-4367
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord() function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
- Record
UBUNTU-CVE-2026-4367- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-90198 No score
CVE-2026-4367 affecting package libXpm for versions less than 3.5.19-1
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the xpmNextWord() function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
- Record
AZL-90198- Updated
- 2026-11-02
OSVMGASA-2026-0186 No score
Updated libxpm packages fix security vulnerability
libXpm Out-of-bounds read in xpmNextWord(). (CVE-2026-4367)
- Record
MGASA-2026-0186- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10608-1 No score
libXpm-devel-3.5.18-2.1 on GA media
These are all security issues fixed in the libXpm-devel-3.5.18-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10608-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20953-1 No score
Security update for libXpm
This update for libXpm fixes the following issue:
- CVE-2026-4367: out-of-bounds read in
xpmNextWord()(bsc#1260928).
- Record
openSUSE-SU-2026:20953-1- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-4367 No score
CVE-2026-4367 in libxpm - Patched by Root
Root has patched CVE-2026-4367 in the libxpm package for Root:Debian:11. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-11-CVE-2026-4367- Updated
- 2026-11-02
OSVSUSE-SU-2026:22121-1 No score
Security update for libXpm
This update for libXpm fixes the following issue:
- CVE-2026-4367: out-of-bounds read in
xpmNextWord()(bsc#1260928).
- Record
SUSE-SU-2026:22121-1- Updated
- 2026-11-02
OSVUSN-8600-1 No score
libxpm vulnerability
Naoki Wakamatsu discovered that libXpm did not properly validate file boundaries when processing XPM image files. An attacker could possibly use this issue to cause libXpm to crash, resulting in a denial of service.
- Record
USN-8600-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libxpmAlpine:v3.20 |
before 3.5.19-r0 | 3.5.19-r0 |
libxpmAlpine:v3.21 |
before 3.5.19-r0 | 3.5.19-r0 |
libxpmAlpine:v3.22 |
before 3.5.19-r0 | 3.5.19-r0 |
libxpmAlpine:v3.23 |
before 3.5.19-r0 | 3.5.19-r0 |
libxpmAlpine:v3.24 |
before 3.5.19-r0 | 3.5.19-r0 |
libXpmAzure Linux:3 |
before 3.5.19-1 | 3.5.19-1 |
libxpmAlpaquita:23 |
3.5.14-r0 up to 3.5.19-r0 | 3.5.19-r0 |
libxpmAlpaquita:25 |
3.5.17-r0 up to 3.5.19-r0 | 3.5.19-r0 |
libxpmAlpaquita:stream |
3.5.14-r0 up to 3.5.19-r0 | 3.5.19-r0 |
libxpmBellSoft Hardened Containers:23 |
3.5.14-r0 up to 3.5.19-r0 | 3.5.19-r0 |
Show 38 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libxpmBellSoft Hardened Containers:25 |
3.5.17-r0 up to 3.5.19-r0 | 3.5.19-r0 |
libxpmBellSoft Hardened Containers:stream |
3.5.14-r0 up to 3.5.19-r0 | 3.5.19-r0 |
libxpmDebian:12 |
All versions, plus listed versions 1:3.5.12-1.11:3.5.12-1.1+deb12u11:3.5.17-11:3.5.19-1 |
None known |
libxpmDebian:13 |
before 1:3.5.17-1+deb13u1, plus listed versions 1:3.5.17-1 |
1:3.5.17-1+deb13u1 |
libxpmDebian:14 |
before 1:3.5.19-1, plus listed versions 1:3.5.17-1 |
1:3.5.19-1 |
libxpmMageia:9 |
before 3.5.15-1.2.mga9 | 3.5.15-1.2.mga9 |
libXpmopenEuler:20.03-LTS-SP4 |
before 3.5.13-4.oe2003sp4 | 3.5.13-4.oe2003sp4 |
libXpmopenEuler:22.03-LTS-SP4 |
before 3.5.13-6.oe2203sp4 | 3.5.13-6.oe2203sp4 |
libXpmopenEuler:24.03-LTS |
before 3.5.17-2.oe2403sp3 | 3.5.17-2.oe2403sp3 |
libXpmopenEuler:24.03-LTS-SP1 |
before 3.5.17-2.oe2403sp1 | 3.5.17-2.oe2403sp1 |
libXpmopenEuler:24.03-LTS-SP3 |
before 3.5.17-2.oe2403sp3 | 3.5.17-2.oe2403sp3 |
libXpmRed Hat:hummingbird:1 |
before 0:3.5.17-7.2.hum1 | 0:3.5.17-7.2.hum1 |
libXpm-develRed Hat:hummingbird:1 |
before 0:3.5.17-7.2.hum1 | 0:3.5.17-7.2.hum1 |
libXpmRed Hat:hummingbird:1 |
before 0:3.5.19-4.hum1 | 0:3.5.19-4.hum1 |
libXpm-develRed Hat:hummingbird:1 |
before 0:3.5.19-4.hum1 | 0:3.5.19-4.hum1 |
libxpmRoot:Debian:11 |
before 1:3.5.12-1.1+deb11u1.aikido.2 | 1:3.5.12-1.1+deb11u1.aikido.21:3.5.12-1.1+deb11u1.aikido.31:3.5.12-1.1+deb11u1.aikido.41:3.5.12-1.1+deb11u1.root.io.1 |
rootio-libxpmRoot:Debian:11 |
before 1:3.5.12-1.1+deb11u1.aikido.2 | 1:3.5.12-1.1+deb11u1.aikido.21:3.5.12-1.1+deb11u1.aikido.31:3.5.12-1.1+deb11u1.aikido.41:3.5.12-1.1+deb11u1.root.io.1 |
libXpmSUSE:Linux Enterprise Server 16.0 |
before 3.5.17-160000.3.1 | 3.5.17-160000.3.1 |
libXpmSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 3.5.17-160000.3.1 | 3.5.17-160000.3.1 |
libxpmUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:3.5.10-11:3.5.10-1ubuntu0.11:3.5.10-1ubuntu0.1+esm11:3.5.10-1ubuntu0.1+esm2 |
None known |
motifUbuntu:14.04:LTS |
All versions, plus listed versions 2.3.4-42.3.4-52.3.4-5ubuntu0.1 |
None known |
libxpmUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:3.5.11-11:3.5.11-1ubuntu0.16.04.11:3.5.11-1ubuntu0.16.04.1+esm11:3.5.11-1ubuntu0.16.04.1+esm2 |
None known |
motifUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.4-8ubuntu12.3.4-92.3.4-10 |
None known |
libxpmUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:3.5.12-11:3.5.12-1ubuntu0.18.04.21:3.5.12-1ubuntu0.18.04.2+esm1 |
None known |
motifUbuntu:18.04:LTS |
All versions, plus listed versions 2.3.7-22.3.8-12.3.8-22.3.8-2build1 |
None known |
libxpmUbuntu:20.04:LTS |
All versions, plus listed versions 1:3.5.12-11:3.5.12-1ubuntu0.20.04.11:3.5.12-1ubuntu0.20.04.2 |
None known |
motifUbuntu:20.04:LTS |
All versions, plus listed versions 2.3.8-2build1 |
None known |
libxpmUbuntu:22.04:LTS |
before 1:3.5.12-1ubuntu0.22.04.3, plus listed versions 1:3.5.12-11:3.5.12-1build11:3.5.12-1build21:3.5.12-1ubuntu0.22.04.11:3.5.12-1ubuntu0.22.04.2 |
1:3.5.12-1ubuntu0.22.04.3 |
motifUbuntu:22.04:LTS |
All versions, plus listed versions 2.3.8-3 |
None known |
libxpmUbuntu:24.04:LTS |
before 1:3.5.17-1ubuntu0.24.04.1, plus listed versions 1:3.5.12-1.1ubuntu11:3.5.17-11:3.5.17-1build11:3.5.17-1build2 |
1:3.5.17-1ubuntu0.24.04.1 |
motifUbuntu:24.04:LTS |
All versions, plus listed versions 2.3.8-32.3.8-3.12.3.8-3.1build1 |
None known |
libxpmUbuntu:25.10 |
All versions, plus listed versions 1:3.5.17-1build2 |
None known |
motifUbuntu:25.10 |
All versions, plus listed versions 2.3.8-42.3.8-5 |
None known |
motifUbuntu:26.10 |
All versions, plus listed versions 2.3.8-5build1 |
None known |
libxpmUbuntu:26.04:LTS |
before 1:3.5.17-1ubuntu0.26.04.1, plus listed versions 1:3.5.17-1build21:3.5.17-1build3 |
1:3.5.17-1ubuntu0.26.04.1 |
motifUbuntu:26.04:LTS |
All versions, plus listed versions 2.3.8-52.3.8-5build1 |
None known |
libXpmopenSUSE:Tumbleweed |
before 3.5.18-2.1 | 3.5.18-2.1 |
libXpmopenSUSE:Leap 16.0 |
before 3.5.17-160000.3.1 | 3.5.17-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-4367 is a medium vulnerability (CVSS 5.5) in Red Hat Enterprise Linux 10, published April 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in libxpm 3.5.19-r0.
References
access.redhat.com/errata/RHSA-2026:30354
bugzilla.redhat.com/show_bug.cgi?id=2448984
gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/5448e1bd
seclists.org/oss-sec/2026/q2/192
Show 28 moreShow less
openwall.com/lists/oss-security/2026/04/21/3
nvd.nist.gov/vuln/detail/CVE-2026-4367
github.com/advisories/GHSA-c2rx-36v4-qc8g
security.alpinelinux.org/vuln/CVE-2026-4367
docs.bell-sw.com/security/cves/CVE-2026-4367
catalog.redhat.com/software/containers
security-tracker.debian.org/tracker/CVE-2026-4367
advisories.mageia.org/MGASA-2026-0186.html
bugs.mageia.org/show_bug.cgi?id=35415
lists.opensuse.org/archives/list/[email protected]/message/RVKVREGNUTRNFASWOP3IK7BSE3RXDHLZ
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2151
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30354.json
cve.org/CVERecord?id=CVE-2026-4367
suse.com/support/update/announcement/2026/suse-su-202622121-1
bugzilla.suse.com/1260928
ubuntu.com/security/CVE-2026-4367