CVE-2026-94287 Denial of service via unsigned underflow in libXpm's write path
Local attackers can cause denial of service via unbounded CPU and memory usage due to an unsigned underflow in libXpm's write path.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-94287?
CVE-2026-94287 is a medium-severity vulnerability in x.org libXpm, published on 28 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.
Weakness: CWE-1050
Which versions are affected by CVE-2026-94287?
Linux distribution packages (8)
libXpm SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 3.5.12-150000.3.13.1 |
libXpm SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 3.5.12-150000.3.13.1 |
libXpm SUSE:Linux Enterprise Server 16.0 | All versions | 3.5.17-160000.4.1 |
libXpm SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.5.11-6.13.1 |
libXpm SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 3.5.17-160000.4.1 |
libXpm SUSE:Linux Enterprise Workstation Extension 15 SP7 | All versions | 3.5.12-150000.3.13.1 |
libXpm openSUSE:Leap 16.0 | All versions | 3.5.17-160000.4.1 |
libXpm openSUSE:Tumbleweed | All versions | 3.5.18-3.1 |
How do I fix CVE-2026-94287?
Upgrade to a fixed version.
Is CVE-2026-94287 being exploited?
There is no known exploitation of CVE-2026-94287 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-94287, BELL-CVE-2026-94287, DEBIAN-CVE-2026-94287, ECHO-35bc-714c-9ad7, GHSA-ggh5-2m6x-59xg, MGASA-2026-0527 and 11 more.