Executive brief
A vulnerability was found in libXpm, a library used by many Linux applications to handle X PixMap (XPM) image files. By providing a specially crafted or malformed image file, a local user can cause applications using this library to crash. This results in a denial-of-service condition, potentially disrupting system operations or specific software tools that process these images.
Technical details
An out-of-bounds read vulnerability exists in libXpm's xpmNextWord() function due to improper boundary validation during XPM file parsing. The root cause is in the internal xpmNextString() function, which fails to check for a NULL terminator when searching for the start of a new string, and xpmParseColors(), which fails to validate the return status of xpmNextString(). A local attacker with low privileges can provide a malformed or truncated XPM file that causes internal pointers to advance beyond the allocated buffer. This results in an invalid memory read and subsequent application crash (Denial of Service). The issue is fixed in libXpm version 3.5.19.
Affected products
- X.Org libXpm prior to 3.5.19
Timeline
- 2026-02-17: patched: Fix committed to GitLab repository
- 2026-03-19: other: Vulnerability reported to Red Hat Bugzilla
- 2026-04-21: advisory: X.Org security advisory released
- 2026-06-16: disclosed: CVE published to NVD