CVE-2026-4367
Description
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
Summary dbcve.org
libXpm contains an Out-of-Bounds Read vulnerability in the xpmNextWord() function due to improper validation of file boundaries. When processing specially crafted or very small XPM (X PixMap) image files, an internal pointer can read beyond the file's end, causing application crashes and denial of service.
Mitigation
Apply available patches for libXpm. Until a patch is available, validate XPM files before processing and consider restricting processing to trusted files only.