oss-security - Fwd: X.Org Security Advisory: CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord()

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAP=2yyT-op1zrHa1nwa_6FszFTPAA+JTOiXUvMAws5DVt87gkw@mail.gmail.com>
Date: Tue, 21 Apr 2026 15:18:45 +0200
From: Olivier Fourdan <ofourdan@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Fwd: X.Org Security Advisory: CVE-2026-4367: libXpm Out-of-bounds
 read in xpmNextWord()

---------- Forwarded message ---------
From: Olivier Fourdan <ofourdan@...hat.com>
Date: Tue, Apr 21, 2026 at 3:15 PM
Subject: X.Org Security Advisory: CVE-2026-4367: libXpm Out-of-bounds
read in xpmNextWord()
To: <xorg-announce@...ts.x.org>
Cc: <xorg@...ts.x.org>, xorg-devel <xorg-devel@...ts.x.org>, <vuls@...ert.or.jp>

======================================================================
X.Org Security Advisory: April 21, 2026

Issue in libXpm prior to version 3.5.19
======================================================================

An issue has been found in the libXpm library published by X.Org for which
we are releasing a security fix for in libXpm-3.5.19.

* CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord()

   libXpm uses a number of internal helper functions to parse the XPM file
   format.
   One of these internal functions, xpmNextString(), checks for the NULL
   terminator when looking for the end of the current string but not when
   looking for the beginning of the next string.
   A small XPM file with a malformed color table definition may cause the
   function xpmNextWord(), called from xpmParseColors() following a call
   to xpmNextString(), to start past the actual end of the file, causing
   an out-of-bound read.

   Introduced in: Unknown, prior to 3.5.5 (from Xorg 7.1)
   Fixed in: libXpm-3.5.19
   Fix: https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/5448e1bd
   Found by: Naoki Wakamatsu

View attachment "OpenPGP_0x14706DBE1E4B4540.asc" of type "text/plain" (3037 bytes)

View attachment "OpenPGP_signature.asc" of type "text/plain" (209 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.