A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU… (CVE-2026-94287)
A denial of service vulnerability exists in libXpm before version 3.5.19 due to improper handling of XPM images with zero-dimension values, causing an unsigned underflow in the write path. Local attackers could exploit this flaw to cause unbounded CPU usage and memory exhaustion, leading to a crash or resource exhaustion. The issue affects multiple Ubuntu releases and has been addressed in updated package versions.
AI Analysis
Technical Summary
CVE-2026-94287 is a denial of service vulnerability in libXpm's write path caused by an unsigned integer underflow. The vulnerability arises from improper handling of XPM images that specify zero dimensions, which can trigger excessive resource consumption, including unbounded CPU usage and memory exhaustion. This flaw affects libXpm versions prior to 3.5.19 and has been addressed in updated package versions for various Ubuntu LTS releases.
Potential Impact
Local attackers can exploit this vulnerability by providing specially crafted XPM image files with zero-dimension values to libXpm, causing the library to consume excessive CPU and memory resources, resulting in a denial of service. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
A fix is available and has been released in updated libXpm package versions for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS. Users should apply the official patches by updating to libxpm4 version 1:3.5.17-1ubuntu0.24.04.2 or later for 24.04 LTS, 1:3.5.17-1ubuntu0.26.04.2 or later for 26.04 LTS, and 1:3.5.12-1ubuntu0.22.04.4 or later for 22.04 LTS. Standard system updates will apply these fixes. No additional mitigation steps are required.
A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU… (CVE-2026-94287)
Description
A denial of service vulnerability exists in libXpm before version 3.5.19 due to improper handling of XPM images with zero-dimension values, causing an unsigned underflow in the write path. Local attackers could exploit this flaw to cause unbounded CPU usage and memory exhaustion, leading to a crash or resource exhaustion. The issue affects multiple Ubuntu releases and has been addressed in updated package versions.
CVSS v3.1
Score 5.5medium
Affected software
pkg:deb/ubuntu/libxpm?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/motif?arch=source&distro=trustypkg:deb/ubuntu/libxpm?arch=source&distro=esm-infra/xenialpkg:deb/ubuntu/motif?arch=source&distro=xenialpkg:deb/ubuntu/libxpm?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/motif?arch=source&distro=bionicpkg:deb/ubuntu/libxpm?arch=source&distro=focalpkg:deb/ubuntu/motif?arch=source&distro=focalpkg:deb/ubuntu/libxpm?arch=source&distro=jammypkg:deb/ubuntu/motif?arch=source&distro=jammypkg:deb/ubuntu/libxpm?arch=source&distro=noblepkg:deb/ubuntu/motif?arch=source&distro=noblepkg:deb/ubuntu/libxpm?arch=source&distro=resolutepkg:deb/ubuntu/motif?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-94287 is a denial of service vulnerability in libXpm's write path caused by an unsigned integer underflow. The vulnerability arises from improper handling of XPM images that specify zero dimensions, which can trigger excessive resource consumption, including unbounded CPU usage and memory exhaustion. This flaw affects libXpm versions prior to 3.5.19 and has been addressed in updated package versions for various Ubuntu LTS releases.
Potential Impact
Local attackers can exploit this vulnerability by providing specially crafted XPM image files with zero-dimension values to libXpm, causing the library to consume excessive CPU and memory resources, resulting in a denial of service. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
A fix is available and has been released in updated libXpm package versions for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS. Users should apply the official patches by updating to libxpm4 version 1:3.5.17-1ubuntu0.24.04.2 or later for 24.04 LTS, 1:3.5.17-1ubuntu0.26.04.2 or later for 26.04 LTS, and 1:3.5.12-1ubuntu0.22.04.4 or later for 22.04 LTS. Standard system updates will apply these fixes. No additional mitigation steps are required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-94287
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Patch Information
Threat ID: 6abeb3f7a43b0b3b89ed4868
Added to database: 10/01/2026, 19:26:47 UTC
Last enriched: 10/01/2026, 19:36:51 UTC
Last updated: 10/01/2026, 19:45:56 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.