Skip to content
OpenAdvisories
Medium USN-8862-1 1 CVE

libxpm vulnerability

Published Oct 1, 2026 · Updated Oct 2, 2026

Ecosystem: Ubuntu

Summary

It was discovered that libXpm did not correctly handle XPM images with
zero-dimension values. A local attacker could possibly use this issue to
cause libXpm to use excessive resources, leading to a denial of service.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS libxpm 1:3.5.12-1ubuntu0.22.04.4
Ubuntu · 24.04 LTS 24.04:LTS libxpm 1:3.5.17-1ubuntu0.24.04.2
Ubuntu · 26.04 LTS 26.04:LTS libxpm 1:3.5.17-1ubuntu0.26.04.2

Vulnerabilities 1

  • Medium 5.5
    CVE-2026-94287

    Denial of service via unsigned underflow in libXpm's write path

    A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

    X.Org libXpm libxpm motif Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-94287