CVE-2026-94287
Published: September 29, 2026Last modified: October 15, 2026
Description
A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.5 |
| Attack Vector | LOCAL |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity impact | NONE |
| Availability impact | HIGH |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | libxpm | Unknown (3.5.14-r0) |
| 25 LTS | libxpm | Fixed (3.5.19-r1) | |
| Stream | libxpm | Fixed (3.5.19-r1) | |
| Hardened Containers | 23 LTS | libxpm | Unknown (3.5.14-r0) |
| 25 LTS | libxpm | Fixed (3.5.19-r1) | |
| Stream | libxpm | Fixed (3.5.19-r1) |