An out-of-bounds read vulnerability exists in the xpmNextWord() function of libXpm in Red Hat Enterprise Linux 10. This flaw allows a local low-privileged user to cause an application crash or denial of service by processing a specially crafted or very small XPM image file. The root cause is improper validation of file boundaries, leading to reading beyond the end of the file. The vulnerability affects availability but does not impact confidentiality or integrity. Red Hat has published an advisory but has not provided explicit information about a patch or remediation level as of the advisory date.

The vulnerability can cause denial of service by crashing applications that process maliciously crafted XPM image files. There is no reported impact on confidentiality or integrity. Exploitation requires local access with low privileges. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-4367 for current remediation guidance. Until an official fix is available, avoid processing untrusted or suspicious XPM image files to mitigate the risk of denial of service.