CVE-2026-94287CWE-1050

CVE-2026-94287

Medium · published September 28, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
0.8
In the wild
Unconfirmed
What it is

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00100 · 0.8th percentile
Weakness
CWE-1050 · Excessive Platform Resource Consumption within a Loop
Published
2026-09-28T13:17Z
References (1)
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/32/diffs?commit_id=3a68f818b1628d7ad96245b0f4d15a32a015b0ab · [email protected]
EPSS history
Timeline
  • 29 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 28 SEP 08:57Z
    Denial of service via unsigned underflow in libXpm's write path
    cvelistv5