Medium severity · published Sep 28, 2026
CVE-2026-94287
Denial of service via unsigned underflow in libXpm's write path
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libXpm · x.org
before 3.5.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-94287
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-94287
patch
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/32/diffs?commit_id=3a68f818b1628d7ad96245b0f4d15a32a015b0ab
More from libXpm
9.8
CVE-2016-10164
Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service…
8.8
CVE-2022-4883
A flaw was found in libXpm
7.5
CVE-2022-46285
A flaw was found in libXpm
7.5
CVE-2022-44617
A flaw was found in libXpm
5.5
CVE-2023-43788
A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function