{"id":"CVE-2026-94287","aliases":["ALPINE-CVE-2026-94287","BELL-CVE-2026-94287","DEBIAN-CVE-2026-94287","EUVD-2026-88179","GHSA-ggh5-2m6x-59xg","MGASA-2026-0527","OESA-2026-4292","OESA-2026-4293","OESA-2026-4294","OESA-2026-4295","RHSA-2026:47072","SUSE-SU-2026:24204-1","SUSE-SU-2026:4761-1","SUSE-SU-2026:4763-1","UBUNTU-CVE-2026-94287","USN-8862-1","openSUSE-SU-2026:11896-1","openSUSE-SU-2026:22056-1"],"status":"published","title":"Denial of service via unsigned underflow in libXpm's write path","description":"A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00128,"percentile":0.0254,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1050"],"published":"2026-07-28T10:14:00Z","modified":"2026-11-01T05:00:08Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"libxpm","fixed_in":["3.5.20-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libxpm","fixed_in":["3.5.19-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libxpm","fixed_in":["3.5.19-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libxpm","fixed_in":["3.5.19-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"libxpm","fixed_in":["3.5.19-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"libxpm","fixed_in":["3.5.19-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"libxpm","fixed_in":["3.5.19-r1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxpm","fixed_in":["1:3.5.20-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"libxpm","fixed_in":["3.5.19-1.1.mga10"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"libXpm","fixed_in":["3.5.17-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libXpm","fixed_in":["3.5.13-7.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libXpm","fixed_in":["3.5.17-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libXpm","fixed_in":["3.5.17-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libXpm","fixed_in":["3.5.17-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libXpm","fixed_in":["3.5.17-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libXpm","fixed_in":["3.5.11-6.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libXpm","fixed_in":["3.5.12-150000.3.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libXpm","fixed_in":["3.5.12-150000.3.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"libXpm","fixed_in":["3.5.12-150000.3.13.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libxpm","fixed_in":["1:3.5.12-1ubuntu0.22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libxpm","fixed_in":["1:3.5.17-1ubuntu0.24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libxpm","fixed_in":["1:3.5.17-1ubuntu0.26.04.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libXpm","fixed_in":["3.5.18-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libXpm","fixed_in":["3.5.17-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.20-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14-r0"},{"fixed":"3.5.19-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.17-r0"},{"fixed":"3.5.19-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14-r0"},{"fixed":"3.5.19-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14-r0"},{"fixed":"3.5.19-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.17-r0"},{"fixed":"3.5.19-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.14-r0"},{"fixed":"3.5.19-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.12-1.1","1:3.5.12-1.1+deb12u1","1:3.5.17-1","1:3.5.19-1","1:3.5.20-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.17-1","1:3.5.17-1+deb13u1","1:3.5.19-1","1:3.5.20-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.20-1"}]}],"versions":["1:3.5.17-1","1:3.5.19-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.19-1.1.mga10"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.13-7.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.19-4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libXpm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.19-4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.11-6.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.3.13.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.10-1","1:3.5.10-1ubuntu0.1","1:3.5.10-1ubuntu0.1+esm1","1:3.5.10-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.4-4","2.3.4-5","2.3.4-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.11-1","1:3.5.11-1ubuntu0.16.04.1","1:3.5.11-1ubuntu0.16.04.1+esm1","1:3.5.11-1ubuntu0.16.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.4-8ubuntu1","2.3.4-9","2.3.4-10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.12-1","1:3.5.12-1ubuntu0.18.04.2","1:3.5.12-1ubuntu0.18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.7-2","2.3.8-1","2.3.8-2","2.3.8-2build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.12-1","1:3.5.12-1ubuntu0.20.04.1","1:3.5.12-1ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1ubuntu0.22.04.4"}]}],"versions":["1:3.5.12-1","1:3.5.12-1build1","1:3.5.12-1build2","1:3.5.12-1ubuntu0.22.04.1","1:3.5.12-1ubuntu0.22.04.2","1:3.5.12-1ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1ubuntu0.24.04.2"}]}],"versions":["1:3.5.12-1.1ubuntu1","1:3.5.17-1","1:3.5.17-1build1","1:3.5.17-1build2","1:3.5.17-1ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-3","2.3.8-3.1","2.3.8-3.1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-5build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1ubuntu0.26.04.2"}]}],"versions":["1:3.5.17-1build2","1:3.5.17-1build3","1:3.5.17-1ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"motif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-5","2.3.8-5build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1ubuntu0.22.04.4"}]}],"versions":["1:3.5.12-1","1:3.5.12-1build1","1:3.5.12-1build2","1:3.5.12-1ubuntu0.22.04.1","1:3.5.12-1ubuntu0.22.04.2","1:3.5.12-1ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1ubuntu0.24.04.2"}]}],"versions":["1:3.5.12-1.1ubuntu1","1:3.5.17-1","1:3.5.17-1build1","1:3.5.17-1build2","1:3.5.17-1ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libxpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1ubuntu0.26.04.2"}]}],"versions":["1:3.5.17-1build2","1:3.5.17-1build3","1:3.5.17-1ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.18-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libXpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.17-160000.4.1"}]}]}],"products":[{"vendor":"microsoft","product":"libxpm"},{"vendor":"x.org","product":"libxpm"}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/32/diffs?commit_id=3a68f818b1628d7ad96245b0f4d15a32a015b0ab","tags":["patch","fix","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94287","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ggh5-2m6x-59xg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-94287","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-94287","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94287.json","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/lib/libxpm","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-94287","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0527.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36450","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/K7VZ2AXP776DE3BBHUU44LSZH4BNWXRF/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8862-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4292","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4293","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4294","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4295","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47072","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4367","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-94287","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47072.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448984","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4367","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4367","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/5448e1bd","tags":["article"]},{"url":"https://seclists.org/oss-sec/2026/q2/192","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542381","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94287","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624204-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1281669","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94287","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264761-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264763-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-94287","tags":["report"]},{"url":"https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/32","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-94287","title":"Denial of service via unsigned underflow in libXpm's write path","description":"A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.","status":"published","published":"2026-09-28T08:57:24.943Z","modified":"2026-09-28T13:31:29.548Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-1050"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-88179","description":"A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.","status":"published","published":"2026-09-28T08:57:24Z","modified":"2026-09-28T13:31:29Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:53.425914Z"}],"ghsa":[{"id":"GHSA-ggh5-2m6x-59xg","title":"A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could...","description":"A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.","status":"published","published":"2026-09-28T09:30:32Z","modified":"2026-09-28T09:30:40Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-1050"],"updated_at":"2026-11-02T15:12:32.013867Z"}],"nvd":[{"id":"CVE-2026-94287","description":"A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.","status":"published","published":"2026-09-28T09:17:08.577Z","modified":"2026-09-29T21:32:59.833Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-1050"],"updated_at":"2026-11-02T14:12:52.081323Z"}],"osv":[{"id":"ALPINE-CVE-2026-94287","description":"A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.","status":"published","published":"2026-09-28T09:17:08.577Z","modified":"2026-10-18T10:30:03.285039186Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BELL-CVE-2026-94287","status":"published","published":"2026-09-29T06:05:58.94401Z","modified":"2026-10-16T07:15:02.447483665Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:27.468539Z"},{"id":"CVE-2026-94287","title":"Denial of service via unsigned underflow in libXpm's write path","description":"A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.","status":"published","published":"2026-09-28T08:57:24.943Z","modified":"2026-10-28T02:30:23.006666266Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-1050"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"DEBIAN-CVE-2026-94287","description":"A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.","status":"published","published":"2026-09-28T09:17:08.577Z","modified":"2026-11-01T05:00:08.034680443Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"OESA-2026-4292","title":"libXpm security update","description":"X.Org X11 libXpm runtime library\r\n\r\nSecurity Fix(es):\n\nA denial of service via unsigned underflow in libXpm\u0026apos;s write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.(CVE-2026-94287)","status":"published","published":"2026-10-16T11:59:00Z","modified":"2026-10-16T12:15:07.565973602Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4293","title":"libXpm security update","description":"X.Org X11 libXpm runtime library\r\n\r\nSecurity Fix(es):\n\nA denial of service via unsigned underflow in libXpm\u0026apos;s write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.(CVE-2026-94287)","status":"published","published":"2026-10-16T11:59:01Z","modified":"2026-10-16T12:15:07.175987435Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4294","title":"libXpm security update","description":"X.Org X11 libXpm runtime library\r\n\r\nSecurity Fix(es):\n\nA denial of service via unsigned underflow in libXpm\u0026apos;s write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.(CVE-2026-94287)","status":"published","published":"2026-10-16T11:59:02Z","modified":"2026-10-16T12:15:07.181516383Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4295","title":"libXpm security update","description":"X.Org X11 libXpm runtime library\r\n\r\nSecurity Fix(es):\n\nA denial of service via unsigned underflow in libXpm\u0026apos;s write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.(CVE-2026-94287)","status":"published","published":"2026-10-16T11:59:02Z","modified":"2026-10-16T12:15:08.084284468Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:47072","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-28T10:14:00Z","modified":"2026-09-29T10:57:36.964690479Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-94287","description":"A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.","status":"published","published":"2026-09-28T09:17:00Z","modified":"2026-10-17T13:01:18.921562776Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"MGASA-2026-0527","title":"Updated libxpm package fixes a security vulnerability","description":"Denial of service via unsigned underflow in libXpm's write path.\n(CVE-2026-94287)\n","status":"published","published":"2026-10-20T02:38:36Z","modified":"2026-10-20T02:43:23.138822305Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11896-1","title":"libXpm-devel-3.5.18-3.1 on GA media","description":"These are all security issues fixed in the libXpm-devel-3.5.18-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-28T00:00:00Z","modified":"2026-09-29T18:23:22.562312872Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22056-1","title":"Security update for libXpm","description":"This update for libXpm fixes the following issue:\n\n- CVE-2026-94287: denial of service via unsigned underflow in libXpm's write path (bsc#1281669).\n","status":"published","published":"2026-10-08T06:15:26Z","modified":"2026-10-19T17:23:10.666065788Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24204-1","title":"Security update for libXpm","description":"This update for libXpm fixes the following issue:\n\n- CVE-2026-94287: denial of service via unsigned underflow in libXpm's write path (bsc#1281669).\n","status":"published","published":"2026-10-08T06:17:19Z","modified":"2026-10-21T17:23:10.136690059Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4761-1","title":"Security update for libXpm","description":"This update for libXpm fixes the following issue:\n\n- CVE-2026-94287: denial of service via unsigned underflow in libXpm's write path (bsc#1281669).\n","status":"published","published":"2026-10-20T13:48:51Z","modified":"2026-10-21T13:00:04.215512635Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4763-1","title":"Security update for libXpm","description":"This update for libXpm fixes the following issue:\n\n- CVE-2026-94287: denial of service via unsigned underflow in libXpm's write path (bsc#1281669).\n","status":"published","published":"2026-10-20T13:49:55Z","modified":"2026-10-21T13:00:04.214264349Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8862-1","title":"libxpm vulnerability","description":"It was discovered that libXpm did not correctly handle XPM images with\nzero-dimension values. A local attacker could possibly use this issue to\ncause libXpm to use excessive resources, leading to a denial of service.","status":"published","published":"2026-10-01T12:51:01Z","modified":"2026-10-02T00:42:48.799330468Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}