The vulnerability CVE-2026-4367 affects the libXpm library in Red Hat Hardened Images. It is an out-of-bounds read in the xpmNextWord() function caused by improper validation of file boundaries when processing X PixMap (XPM) image files. This can lead to reading beyond the end of the file, causing application crashes and denial of service conditions. The flaw requires local access with low privileges and no user interaction. The impact is limited to availability, with no confidentiality or integrity compromise. Red Hat has published an advisory (RHSA-2026:30354) detailing the issue and affected packages but currently does not provide a patch that meets their criteria for release.

Successful exploitation causes denial of service by crashing applications that process XPM image files. This may affect batch processing systems or graphical applications relying on libXpm. There is no impact on confidentiality or integrity. The vulnerability requires local access and low privileges but no user interaction. The overall severity is medium due to the limited impact scope and lack of confidentiality or integrity compromise.

Currently, no official fix or patch meeting Red Hat's criteria for ease of use, deployment, and stability is available. Users should monitor Red Hat advisories for updates. Since exploitation requires local access, restricting untrusted local users and limiting access to systems processing untrusted XPM files can reduce risk. No vendor-provided mitigations are currently available.