CVE-2026-94287

Denial of service via unsigned underflow in libXpm's write path

5.5 MediumFix available

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.13%Unchanged since Sep 28, 2026

What each source reports

CVE List Score used 5.5

Denial of service via unsigned underflow in libXpm's write path

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

Record: CVE-2026-94287
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-1050
Updated: 2026-11-02

EUVDEUVD-2026-88179 5.5

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

Record: EUVD-2026-88179
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-ggh5-2m6x-59xg 5.5

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could...

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

Record: GHSA-ggh5-2m6x-59xg
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-1050
Updated: 2026-11-02

NVD 5.5

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

Record: CVE-2026-94287
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-1050
Updated: 2026-11-02

OSVALPINE-CVE-2026-94287 5.5

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

Record: ALPINE-CVE-2026-94287
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-94287 5.5

Record: BELL-CVE-2026-94287
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 15 moreShow less

OSV 5.5

Denial of service via unsigned underflow in libXpm's write path

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

Record: CVE-2026-94287
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-1050
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-94287 5.5

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

Record: DEBIAN-CVE-2026-94287
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-4292 5.5

libXpm security update

X.Org X11 libXpm runtime library

Security Fix(es):

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.(CVE-2026-94287)

Record: OESA-2026-4292
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-4293 5.5

libXpm security update

X.Org X11 libXpm runtime library

Security Fix(es):

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.(CVE-2026-94287)

Record: OESA-2026-4293
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-4294 5.5

libXpm security update

X.Org X11 libXpm runtime library

Security Fix(es):

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.(CVE-2026-94287)

Record: OESA-2026-4294
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-4295 5.5

libXpm security update

X.Org X11 libXpm runtime library

Security Fix(es):

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.(CVE-2026-94287)

Record: OESA-2026-4295
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:47072 5.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:47072
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-94287 5.5

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

Record: UBUNTU-CVE-2026-94287
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2026-0527 No score

Updated libxpm package fixes a security vulnerability

Denial of service via unsigned underflow in libXpm's write path. (CVE-2026-94287)

Record: MGASA-2026-0527
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11896-1 No score

libXpm-devel-3.5.18-3.1 on GA media

These are all security issues fixed in the libXpm-devel-3.5.18-3.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11896-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:22056-1 No score

Security update for libXpm

This update for libXpm fixes the following issue:

CVE-2026-94287: denial of service via unsigned underflow in libXpm's write path (bsc#1281669).

Record: openSUSE-SU-2026:22056-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24204-1 No score

Security update for libXpm

This update for libXpm fixes the following issue:

CVE-2026-94287: denial of service via unsigned underflow in libXpm's write path (bsc#1281669).

Record: SUSE-SU-2026:24204-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4761-1 No score

Security update for libXpm

This update for libXpm fixes the following issue:

CVE-2026-94287: denial of service via unsigned underflow in libXpm's write path (bsc#1281669).

Record: SUSE-SU-2026:4761-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4763-1 No score

Security update for libXpm

This update for libXpm fixes the following issue:

CVE-2026-94287: denial of service via unsigned underflow in libXpm's write path (bsc#1281669).

Record: SUSE-SU-2026:4763-1
Updated: 2026-11-02

OSVUSN-8862-1 No score

libxpm vulnerability

It was discovered that libXpm did not correctly handle XPM images with zero-dimension values. A local attacker could possibly use this issue to cause libXpm to use excessive resources, leading to a denial of service.

Record: USN-8862-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libxpm` Alpine:v3.24	before 3.5.20-r0	3.5.20-r0
`libxpm` Alpaquita:23	3.5.14-r0 up to 3.5.19-r1	3.5.19-r1
`libxpm` Alpaquita:25	3.5.17-r0 up to 3.5.19-r1	3.5.19-r1
`libxpm` Alpaquita:stream	3.5.14-r0 up to 3.5.19-r1	3.5.19-r1
`libxpm` BellSoft Hardened Containers:23	3.5.14-r0 up to 3.5.19-r1	3.5.19-r1
`libxpm` BellSoft Hardened Containers:25	3.5.17-r0 up to 3.5.19-r1	3.5.19-r1
`libxpm` BellSoft Hardened Containers:stream	3.5.14-r0 up to 3.5.19-r1	3.5.19-r1
`libxpm` Debian:12	All versions, plus listed versions 1:3.5.12-1.11:3.5.12-1.1+deb12u11:3.5.17-11:3.5.19-11:3.5.20-1	None known
`libxpm` Debian:13	All versions, plus listed versions 1:3.5.17-11:3.5.17-1+deb13u11:3.5.19-11:3.5.20-1	None known
`libxpm` Debian:14	before 1:3.5.20-1, plus listed versions 1:3.5.17-11:3.5.19-1	1:3.5.20-1

Show 30 moreShow less

Affected packages
Package	Affected	Fixed
`libxpm` Mageia:10	before 3.5.19-1.1.mga10	3.5.19-1.1.mga10
`libXpm` openEuler:24.03-LTS-SP4	before 3.5.17-3.oe2403sp4	3.5.17-3.oe2403sp4
`libXpm` openEuler:22.03-LTS-SP4	before 3.5.13-7.oe2203sp4	3.5.13-7.oe2203sp4
`libXpm` openEuler:24.03-LTS-SP1	before 3.5.17-3.oe2403sp1	3.5.17-3.oe2403sp1
`libXpm` openEuler:24.03-LTS-SP3	before 3.5.17-3.oe2403sp3	3.5.17-3.oe2403sp3
`libXpm` Red Hat:hummingbird:1 From an advisory covering 2 CVEs	before 0:3.5.19-4.hum1	0:3.5.19-4.hum1
`libXpm-devel` Red Hat:hummingbird:1 From an advisory covering 2 CVEs	before 0:3.5.19-4.hum1	0:3.5.19-4.hum1
`libXpm` SUSE:Linux Enterprise Server 16.0	before 3.5.17-160000.4.1	3.5.17-160000.4.1
`libXpm` SUSE:Linux Enterprise Server for SAP applications 16.0	before 3.5.17-160000.4.1	3.5.17-160000.4.1
`libXpm` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	before 3.5.11-6.13.1	3.5.11-6.13.1
`libXpm` SUSE:Linux Enterprise Module for Basesystem 15 SP7	before 3.5.12-150000.3.13.1	3.5.12-150000.3.13.1
`libXpm` SUSE:Linux Enterprise Module for Package Hub 15 SP7	before 3.5.12-150000.3.13.1	3.5.12-150000.3.13.1
`libXpm` SUSE:Linux Enterprise Workstation Extension 15 SP7	before 3.5.12-150000.3.13.1	3.5.12-150000.3.13.1
`libxpm` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1:3.5.10-11:3.5.10-1ubuntu0.11:3.5.10-1ubuntu0.1+esm11:3.5.10-1ubuntu0.1+esm2	None known
`motif` Ubuntu:14.04:LTS	All versions, plus listed versions 2.3.4-42.3.4-52.3.4-5ubuntu0.1	None known
`libxpm` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1:3.5.11-11:3.5.11-1ubuntu0.16.04.11:3.5.11-1ubuntu0.16.04.1+esm11:3.5.11-1ubuntu0.16.04.1+esm2	None known
`motif` Ubuntu:16.04:LTS	All versions, plus listed versions 2.3.4-8ubuntu12.3.4-92.3.4-10	None known
`libxpm` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1:3.5.12-11:3.5.12-1ubuntu0.18.04.21:3.5.12-1ubuntu0.18.04.2+esm1	None known
`motif` Ubuntu:18.04:LTS	All versions, plus listed versions 2.3.7-22.3.8-12.3.8-22.3.8-2build1	None known
`libxpm` Ubuntu:20.04:LTS	All versions, plus listed versions 1:3.5.12-11:3.5.12-1ubuntu0.20.04.11:3.5.12-1ubuntu0.20.04.2	None known
`motif` Ubuntu:20.04:LTS	All versions, plus listed versions 2.3.8-2build1	None known
`libxpm` Ubuntu:22.04:LTS	before 1:3.5.12-1ubuntu0.22.04.4, plus listed versions 1:3.5.12-11:3.5.12-1build11:3.5.12-1build21:3.5.12-1ubuntu0.22.04.11:3.5.12-1ubuntu0.22.04.21:3.5.12-1ubuntu0.22.04.3	1:3.5.12-1ubuntu0.22.04.4
`motif` Ubuntu:22.04:LTS	All versions, plus listed versions 2.3.8-3	None known
`libxpm` Ubuntu:24.04:LTS	before 1:3.5.17-1ubuntu0.24.04.2, plus listed versions 1:3.5.12-1.1ubuntu11:3.5.17-11:3.5.17-1build11:3.5.17-1build21:3.5.17-1ubuntu0.24.04.1	1:3.5.17-1ubuntu0.24.04.2
`motif` Ubuntu:24.04:LTS	All versions, plus listed versions 2.3.8-32.3.8-3.12.3.8-3.1build1	None known
`motif` Ubuntu:26.10	All versions, plus listed versions 2.3.8-5build1	None known
`libxpm` Ubuntu:26.04:LTS	before 1:3.5.17-1ubuntu0.26.04.2, plus listed versions 1:3.5.17-1build21:3.5.17-1build31:3.5.17-1ubuntu0.26.04.1	1:3.5.17-1ubuntu0.26.04.2
`motif` Ubuntu:26.04:LTS	All versions, plus listed versions 2.3.8-52.3.8-5build1	None known
`libXpm` openSUSE:Tumbleweed	before 3.5.18-3.1	3.5.18-3.1
`libXpm` openSUSE:Leap 16.0	before 3.5.17-160000.4.1	3.5.17-160000.4.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-94287 is a medium vulnerability (CVSS 5.5) in Microsoft Libxpm, published July 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in libxpm 3.5.20-r0.

References

Show 30 moreShow less