CVE-2026-4367CWE-125

Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing

Medium · published June 16, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00154 · 4.2th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-06-16T16:50Z
EPSS history
Timeline
  • 16 JUN 16:50Z
    Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing
    cvelistv5