CVE-2026-94287: Denial of service via unsigned underflow in libXpm's write path
Published Sep 28, 2026
·Updated
A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.
Affected Software
1 affected component
X.Org Libxpm<3.5.19
Event History
Sep 28, 2026
CVE Published
via MITRE·08:57 AM
Data Sourced
via MITRE·08:57 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is realistically exposed to this issue?
Systems using libXpm versions before 3.5.19 are exposed when a local attacker can cause the vulnerable write path to process crafted input. The impact is denial of service through unbounded CPU consumption and memory exhaustion.
2
What access does an attacker need?
The attack vector is local and requires no privileges, but it does require user interaction. The provided information does not specify what form that interaction takes.
3
Which versions need to be remediated?
libXpm releases before 3.5.19 are affected. Updating to 3.5.19 or later removes the affected version range described here.