Read the docs
TI-2026-63394 Aliases CVE-2026-94287GHSA-ggh5-2m6x-59xg

Denial of service via unsigned underflow in libXpm's write path

Priority LOW 24CWE-1050Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00128 2nd percentileScored 2026-11-07
Fix Partial libXpm (x.org): 3.5.19Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
x.orglibXpmbefore 3.5.193.5.19Patch availableCNA
  • libXpm Vendorx.org Affected before 3.5.19 Fixed in 3.5.19 Patch available CNA

Remediation

  • Fix · CNA libXpm (x.org) Fixed in 3.5.19

Red Hat 1 advisory

  • RHSA-2026:47072 Released 2026-07-28 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images libXpm-3.5.19-4.hum1@aarch64, libXpm-3.5.19-4.hum1@src, libXpm-3.5.19-4.hum1@x86_64 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:47072

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-94287
  2. 2026-10-03 Alias added: GHSA-ggh5-2m6x-59xg

References

Patch 1

  • TI-2022-25238 In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for… CVSS 3.1HIGH 7.7
  • TI-1999-00519 An X server's access control is disabled (e.g. CVSS 2.0HIGH 10.0
  • TI-2021-11657 LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote… CVSS 3.1CRITICAL 9.8
  • TI-2018-10465 An issue was discovered in libX11 through 1.6.5. CVSS 3.0CRITICAL 9.8
  • TI-2004-00826 Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other… CVSS 2.0HIGH 10.0
  • TI-2016-08240 Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM… CVSS 3.0CRITICAL 9.8
See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences