CVE-2026-4367— Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing
Quick assessment
Affected
Red Hat Red Hat Hardened Images
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
X.Org libXpm是X.org基金会的一个图片处理库。 X.Org libXpm存在安全漏洞，该漏洞源于xpmNextWord函数读取内存片段，可能导致获取敏感信息。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1499 · Endpoint Denial of ServiceAffected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
| Red Hat | Red Hat Hardened Images | 3.5.17-7.2.hum1< * |
unaffected |
3.5.19-4.hum1< * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-4367
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
X.Org libXpm 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
X.Org libXpm是X.org基金会的一个图片处理库。 X.Org libXpm存在安全漏洞，该漏洞源于xpmNextWord函数读取内存片段，可能导致获取敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Hardened Images | 3.5.17-7.2.hum1 ~ * |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Hardened Images | 3.5.19-4.hum1 ~ * |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-4367
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-4367
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-4367 (1)
Vendor Advisories for CVE-2026-4367 (3)
-
🔗 2448984 – (CVE-2026-4367) CVE-2026-4367 libXpm: libXpm: Denial of Service via out-of-bounds read in XPM file parsing Read full article issue-tracking x_refsource_REDHAT
-
-
Mailing List Discussions for CVE-2026-4367 (1)
Other References for CVE-2026-4367 (1)
Same Patch Batch · Red Hat · 2026-06-16 · 7 CVEs total
| CVE-2026-10649 | 8.6 HIGH | Pacemaker: pacemaker: denial of service via integer overflow in remote message decompressi |
| CVE-2026-12398 | 7.5 HIGH | Galaxy_ng: shell injection in legacy role import via unsanitized git ref names |
| CVE-2026-1767 | 5.6 MEDIUM | Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading |
| CVE-2026-1766 | 5.6 MEDIUM | Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and inform |
| CVE-2026-1765 | 5.6 MEDIUM | Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and potent |
| CVE-2026-1764 | 5.6 MEDIUM | Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leads t |
IV. Related Vulnerabilities
Same product: Red Hat Hardened Images
-
CVE-2026-95619
Gcc: libstdc++ integer overflow in `new` operator -
CVE-2026-76781
Libxml2: libxml2: null pointer dereference parsing nextcatal -
CVE-2026-42784
Sequoia-openpgp: sequoia-openpgp: cryptographic integrity co -
CVE-2026-85013
Environment-modules: command injection in environment-module -
CVE-2026-18495
Libtiff: libtiff: heap-buffer overflow via numeric truncatio
Same vendor: Red Hat
-
CVE-2026-13087
Kernel: heap out-of-bounds write in the linux kernel rpc-ove -
CVE-2026-90462
Sssd: sssd: fail-open in ldap ppolicy access check allows co -
CVE-2026-94640
Rpcbind: unbounded memory allocation in rpcbind statistics t -
CVE-2026-95619
Gcc: libstdc++ integer overflow in `new` operator -
CVE-2026-95508
Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp resp
V. Comments for CVE-2026-4367
No comments yet