CVE catalog

CVE-2026-4367

A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X Pi

[CVE catalog]

Severity
Medium · CVSS 6.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.13% · Oct 27, 2026

A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxpmsid1:3.5.20-1fixed
Debianlibxpmforky1:3.5.19-1fixed
Debianlibxpmtrixie1:3.5.17-1+deb13u1fixed
Debianlibxpmbookworm1:3.5.12-1.1+deb12u1vulnerable
Debianlibxpmbookworm-security1:3.5.12-1.1+deb12u1vulnerable
CpelibxpmNot reportedNot reportedvulnerable
Ubuntulibxpmnoble1:3.5.17-1ubuntu0.24.04.1fixed
Ubuntulibxpm-devnoble1:3.5.17-1ubuntu0.24.04.1fixed
Ubuntulibxpm4noble1:3.5.17-1ubuntu0.24.04.1fixed
Ubuntuxpmutilsnoble1:3.5.17-1ubuntu0.24.04.1fixed
Alpinelibxpm3.203.5.19-r0fixed
Alpinelibxpm3.213.5.19-r0fixed
Alpinelibxpm3.223.5.19-r0fixed
Alpinelibxpm3.233.5.19-r0fixed
Alpinelibxpm3.243.5.19-r0fixed
Ubuntulibxpm22.041:3.5.12-1vulnerable
Ubuntulibxpm22.041:3.5.12-1build1vulnerable
Ubuntulibxpm22.041:3.5.12-1build2vulnerable
Ubuntulibxpm22.041:3.5.12-1ubuntu0.22.04.1vulnerable
Ubuntulibxpm22.041:3.5.12-1ubuntu0.22.04.2vulnerable
Ubuntulibxpm22.041:3.5.12-1ubuntu0.22.04.3fixed
Ubuntulibxpm24.041:3.5.12-1.1ubuntu1vulnerable
Ubuntulibxpm24.041:3.5.17-1vulnerable
Ubuntulibxpm24.041:3.5.17-1build1vulnerable
Ubuntulibxpm24.041:3.5.17-1build2vulnerable
Ubuntulibxpm24.041:3.5.17-1ubuntu0.24.04.1fixed
Ubuntulibxpm26.041:3.5.17-1build2vulnerable
Ubuntulibxpm26.041:3.5.17-1build3vulnerable
Ubuntulibxpm26.041:3.5.17-1ubuntu0.26.04.1fixed
SuselibXpmlinux enterprise server 16.03.5.17-160000.3.1fixed
SuselibXpmlinux enterprise server for sap applications 16.03.5.17-160000.3.1fixed
OpensuselibXpmleap 16.03.5.17-160000.3.1fixed
OpensuselibXpmtumbleweed3.5.18-2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxpmsourcesid1:3.5.19-1not yet assignedNot reported[1134690]
Debianlibxpmsourceforky1:3.5.19-1not yet assignedNot reported[1134690]
Debianlibxpmsourcetrixie1:3.5.17-1+deb13u1not yet assignedNot reported[1134690]
Debianlibxpmsourcebookworm(unfixed)not yet assignedNot reported[1134690]
Ubuntulibxpmdebnoble1:3.5.17-1ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntulibxpm-devdebnoble1:3.5.17-1ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntulibxpm4debnoble1:3.5.17-1ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntuxpmutilsdebnoble1:3.5.17-1ubuntu0.24.04.1Not reportedNot reportedNot reported
Alpinelibxpmapk3.203.5.19-r0Not reportedALPINE-CVE-2026-4367Not reported
Alpinelibxpmapk3.213.5.19-r0Not reportedALPINE-CVE-2026-4367Not reported
Alpinelibxpmapk3.223.5.19-r0Not reportedALPINE-CVE-2026-4367Not reported
Alpinelibxpmapk3.233.5.19-r0Not reportedALPINE-CVE-2026-4367Not reported
Alpinelibxpmapk3.243.5.19-r0Not reportedALPINE-CVE-2026-4367Not reported
Ubuntulibxpmdeb22.041:3.5.12-1ubuntu0.22.04.3Not reportedUSN-8600-1Not reported
Ubuntulibxpmdeb24.041:3.5.17-1ubuntu0.24.04.1Not reportedUSN-8600-1Not reported
Ubuntulibxpmdeb26.041:3.5.17-1ubuntu0.26.04.1Not reportedUSN-8600-1Not reported
SuselibXpmrpmlinux enterprise server 16.03.5.17-160000.3.1Not reportedSUSE-SU-2026:22121-1Not reported
SuselibXpmrpmlinux enterprise server for sap applications 16.03.5.17-160000.3.1Not reportedSUSE-SU-2026:22121-1Not reported
OpensuselibXpmrpmleap 16.03.5.17-160000.3.1Not reportedOPENSUSE-SU-2026:20953-1Not reported
OpensuselibXpmrpmtumbleweed3.5.18-2.1Not reportedOPENSUSE-SU-2026:10608-1Not reported

[Debian bug #1134690]

Notes

[bookworm] libxpm: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libxpm4]Affected

    Source package: [libxpm]

    Details (4)

    • 1:3.5.12-1.1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libxpm · debian · bookworm; nvd · libxpm · debian · 12

    • 1:3.5.12-1.1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libxpm · debian · bookworm; nvd · libxpm · debian · 12

    • 1:3.5.12-1.1+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · libxpm · debian · bookworm; nvd · libxpm · debian · 12

    • 1:3.5.12-1.1+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · libxpm · debian · bookworm; nvd · libxpm · debian · 12

  • [libxpm-dev]Affected

    Source package: [libxpm]

    Details (4)

    • 1:3.5.12-1.1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libxpm · debian · bookworm; nvd · libxpm · debian · 12

    • 1:3.5.12-1.1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libxpm · debian · bookworm; nvd · libxpm · debian · 12

    • 1:3.5.12-1.1+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · libxpm · debian · bookworm; nvd · libxpm · debian · 12

    • 1:3.5.12-1.1+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · libxpm · debian · bookworm; nvd · libxpm · debian · 12

  • [xpmutils]Affected

    Source package: [libxpm]

    Details (4)

    • 1:3.5.12-1.1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libxpm · debian · bookworm; nvd · libxpm · debian · 12

    • 1:3.5.12-1.1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libxpm · debian · bookworm; nvd · libxpm · debian · 12

    • 1:3.5.12-1.1+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · libxpm · debian · bookworm; nvd · libxpm · debian · 12

    • 1:3.5.12-1.1+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · libxpm · debian · bookworm; nvd · libxpm · debian · 12

[openSUSE Tumbleweed]

  • [libXpm4]Unknown

    Source package: [libXpm]

    Details (1)

    • 3.5.18-2.4 · x86_64 · tumbleweed

      Unknown · Fixed: 3.5.18-2.1

      Version impact unknown

      nvd · libXpm · opensuse · tumbleweed

  • [libXpm4-32bit]Unknown

    Source package: [libXpm]

    Details (1)

    • 3.5.18-2.4 · x86_64 · tumbleweed

      Unknown · Fixed: 3.5.18-2.1

      Version impact unknown

      nvd · libXpm · opensuse · tumbleweed

  • [libXpm-devel]Unknown

    Source package: [libXpm]

    Details (1)

    • 3.5.18-2.4 · x86_64 · tumbleweed

      Unknown · Fixed: 3.5.18-2.1

      Version impact unknown

      nvd · libXpm · opensuse · tumbleweed

  • [libXpm-devel-32bit]Unknown

    Source package: [libXpm]

    Details (1)

    • 3.5.18-2.4 · x86_64 · tumbleweed

      Unknown · Fixed: 3.5.18-2.1

      Version impact unknown

      nvd · libXpm · opensuse · tumbleweed

  • [libXpm-tools]Unknown

    Source package: [libXpm]

    Details (1)

    • 3.5.18-2.4 · x86_64 · tumbleweed

      Unknown · Fixed: 3.5.18-2.1

      Version impact unknown

      nvd · libXpm · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [libxpm4]Fixed

    Source package: [libxpm]

    Details (2)

    • 1:3.5.17-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1:3.5.17-1+deb13u1

      nvd · libxpm · debian · 13

    • 1:3.5.17-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1:3.5.17-1+deb13u1

      nvd · libxpm · debian · 13

  • [libxpm-dev]Fixed

    Source package: [libxpm]

    Details (2)

    • 1:3.5.17-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1:3.5.17-1+deb13u1

      nvd · libxpm · debian · 13

    • 1:3.5.17-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1:3.5.17-1+deb13u1

      nvd · libxpm · debian · 13

  • [xpmutils]Fixed

    Source package: [libxpm]

    Details (2)

    • 1:3.5.17-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1:3.5.17-1+deb13u1

      nvd · libxpm · debian · 13

    • 1:3.5.17-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1:3.5.17-1+deb13u1

      nvd · libxpm · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]