Out-of-bounds read in libXpm - CVE-2026-4367

Vulnerability identifier: #VU126829

CSH Severity: Medium

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-4367

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in xpmNextWord() when parsing a malformed color table definition in an XPM file. A remote attacker can supply a specially crafted XPM file to disclose sensitive information.

User interaction is required to process the crafted XPM file.

libXpm
openEuler
Ubuntu
Anolis OS
libxpm4 (Ubuntu package)
xpmutils (Ubuntu package)
libXpm
libXpm-debuginfo
libXpm-debugsource
libXpm-devel
libXpm-help
libXpm-doc

Install security update from vendor's website.

libXpm - update to 3.5.19
libxpm4 (Ubuntu package) - addressed in versions 1:3.5.12-1ubuntu0.22.04.3, 1:3.5.17-1ubuntu0.24.04.1, 1:3.5.17-1ubuntu0.26.04.1
xpmutils (Ubuntu package) - addressed in versions 1:3.5.12-1ubuntu0.22.04.3, 1:3.5.17-1ubuntu0.24.04.1, 1:3.5.17-1ubuntu0.26.04.1
libXpm - update to 3.5.13-4
libXpm-debuginfo - update to 3.5.13-4
libXpm-debugsource - update to 3.5.13-4
libXpm-devel - update to 3.5.13-4
libXpm-help - update to 3.5.13-4
libXpm - update to 3.5.17-2
libXpm-devel - update to 3.5.17-2
libXpm-doc - update to 3.5.17-2

• https://www.openwall.com/lists/oss-security/2026/04/21/3

• Information disclosure in libXpm
• openEuler update for libXpm
• Anolis OS update for libXpm
• Ubuntu update for libxpm