CVEvulnerability
CVE-2026-4367
5.5 MEDIUM
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-06-16
- Last modified
- 2026-07-28
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-125
Description
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- https://access.redhat.com/errata/RHSA-2026:30354 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:47072 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2026-4367 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2448984 bugzilla.redhat.com
- https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/5448e1bd gitlab.freedesktop.org
- https://seclists.org/oss-sec/2026/q2/192 seclists.org
- http://www.openwall.com/lists/oss-security/2026/04/21/3 www.openwall.com