Description
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxpm | 1:3.5.19-1 | — |
| Debian 13 | libxpm | 1:3.5.17-1+deb13u1 | — |
| Debian 12 | libxpm | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | motif | No fix yet | — |
| Ubuntu 26.04 LTS | libxpm | 1:3.5.17-1ubuntu0.26.04.1 | USN-8600-1 |
| Ubuntu 26.04 LTS | motif | No fix yet | — |
| Ubuntu 25.10 | motif +1 | No fix yet | — |
| Ubuntu 24.04 LTS | libxpm | 1:3.5.17-1ubuntu0.24.04.1 | USN-8600-1 |
| Ubuntu 24.04 LTS | motif | No fix yet | — |
| Ubuntu 22.04 LTS | libxpm | 1:3.5.12-1ubuntu0.22.04.3 | USN-8600-1 |
| Ubuntu 22.04 LTS | motif | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | motif +1 | No fix yet | — |
| Ubuntu 18.04 LTS | motif | No fix yet | — |
| Ubuntu 16.04 LTS | motif | No fix yet | — |
| Ubuntu 14.04 LTS | motif | No fix yet | — |
| Ubuntu Pro 18.04 LTS | libxpm | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libxpm | No fix yet | — |
| Ubuntu Pro 14.04 LTS | libxpm | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | libXpm +1 | 3.5.17-7.2.hum1 | RHSA-2026:47072, RHSA-2026:30354 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libXpm | 3.5.17-160000.3.1 | SUSE-SU-2026:22121-1 |
| SLES 16.0 | libXpm | 3.5.17-160000.3.1 | SUSE-SU-2026:22121-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libXpm | 3.5.18-2.1 | openSUSE-SU-2026:10608-1 |
| openSUSE Leap 16.0 | libXpm | 3.5.17-160000.3.1 | openSUSE-SU-2026:20953-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libxpm | 3.5.19-r0 | — |
| Alpine v3.23 | libxpm | 3.5.19-r0 | — |
| Alpine v3.22 | libxpm | 3.5.19-r0 | — |
| Alpine v3.21 | libxpm | 3.5.19-r0 | — |
| Alpine v3.20 | libxpm | 3.5.19-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libXpm +1 | 3.5.17-3.amzn2023.0.2 | ALAS2023-2026-1656 |
| Amazon Linux 2 | libXpm +1 | 3.5.12-9.amzn2.0.4 | ALAS2-2026-3291 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libXpm | 3.5.19-1 | — |
Advisories 9
- RHSA-2026:30354 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:47072 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- WID-SEC-2026-1223 OpenBSD: Schwachstelle ermöglicht nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 27, 2026
- USN-8600-1 libxpm vulnerability Ubuntu Security Notices (USN) · Jul 24, 2026
- SUSE-SU-2026:22121-1 Security update for libXpm SUSE / openSUSE Security Updates · Jun 17, 2026
- openSUSE-SU-2026:20953-1 Security update for libXpm SUSE / openSUSE Security Updates · Jun 16, 2026
- ALAS2-2026-3291 Moderate: libXpm security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 13, 2026
- ALAS2023-2026-1656 Moderate: libXpm security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
- openSUSE-SU-2026:10608-1 libXpm-devel-3.5.18-2.1 on GA media SUSE / openSUSE Security Updates · Apr 24, 2026
References
- RHSA-2026:30354 vendor-advisory
- RHSA-2026:47072 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-4367 vdb-entry
- RHBZ#2448984 issue-tracking
- https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/5448e1bd
- https://seclists.org/oss-sec/2026/q2/192