{
  "cveId": "CVE-2026-4367",
  "url": "https://patchblox.com/security/cve/CVE-2026-4367",
  "summary": "CVE-2026-4367 is fixed in 8 products on 1 platform, first by libxpm4 1:3.5.12-1ubuntu0.22.04.3, released April 21, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing",
  "description": "A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the \u0060xpmNextWord()\u0060 function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file\u0027s end, leading to application crashes and Denial of Service conditions.",
  "published": "2026-04-21T06:00:00Z",
  "severity": "Moderate",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "cwe": "Out-of-bounds Read",
  "epss": 0.00129,
  "epssPercentile": 0.02534,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-4367",
  "fixes": [
    {
      "platform": "linux",
      "product": "libXpm",
      "release": "amzn 2023",
      "fixedVersion": "3.5.17-3.amzn2023.0.2",
      "fix": "ALAS2023-2026-1656",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1656",
      "released": "2026-05-11T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libXpm",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.5.17-160000.3.1",
      "fix": "OPENSUSE-SU-2026:20953-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20953-1",
      "released": "2026-06-11T12:46:56Z"
    },
    {
      "platform": "linux",
      "product": "libXpm",
      "release": "sles 16.0",
      "fixedVersion": "3.5.17-160000.3.1",
      "fix": "SUSE-SU-2026:22121-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22121-1",
      "released": "2026-06-11T12:44:37Z"
    },
    {
      "platform": "linux",
      "product": "libXpm-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "3.5.17-3.amzn2023.0.2",
      "fix": "ALAS2023-2026-1656",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1656",
      "released": "2026-05-11T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libXpm-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "3.5.17-3.amzn2023.0.2",
      "fix": "ALAS2023-2026-1656",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1656",
      "released": "2026-05-11T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libXpm-devel",
      "release": "amzn 2023",
      "fixedVersion": "3.5.17-3.amzn2023.0.2",
      "fix": "ALAS2023-2026-1656",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1656",
      "released": "2026-05-11T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libXpm-devel-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "3.5.17-3.amzn2023.0.2",
      "fix": "ALAS2023-2026-1656",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1656",
      "released": "2026-05-11T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxpm",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1:3.5.17-1\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-4367",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-4367",
      "released": "2026-05-15T16:01:09Z"
    },
    {
      "platform": "linux",
      "product": "libxpm",
      "release": "Debian 14",
      "fixedVersion": "1:3.5.19-1",
      "fix": "DEBIAN-CVE-2026-4367",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-4367",
      "released": "2026-05-15T16:01:09Z"
    },
    {
      "platform": "linux",
      "product": "libxpm4",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:3.5.12-1ubuntu0.22.04.3",
      "fix": "libxpm4 1:3.5.12-1ubuntu0.22.04.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libxpm4-1-3.5.12-1ubuntu0.22.04.3",
      "released": "2026-04-21T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxpm4",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1:3.5.17-1ubuntu0.24.04.1",
      "fix": "libxpm4 1:3.5.17-1ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libxpm4-1-3.5.17-1ubuntu0.24.04.1",
      "released": "2026-04-21T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxpm4",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "1:3.5.17-1ubuntu0.26.04.1",
      "fix": "libxpm4 1:3.5.17-1ubuntu0.26.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libxpm4-1-3.5.17-1ubuntu0.26.04.1",
      "released": "2026-04-21T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "xpmutils",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:3.5.12-1ubuntu0.22.04.3",
      "fix": "xpmutils 1:3.5.12-1ubuntu0.22.04.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-xpmutils-1-3.5.12-1ubuntu0.22.04.3",
      "released": "2026-04-21T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "xpmutils",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1:3.5.17-1ubuntu0.24.04.1",
      "fix": "xpmutils 1:3.5.17-1ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-xpmutils-1-3.5.17-1ubuntu0.24.04.1",
      "released": "2026-04-21T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "xpmutils",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "1:3.5.17-1ubuntu0.26.04.1",
      "fix": "xpmutils 1:3.5.17-1ubuntu0.26.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-xpmutils-1-3.5.17-1ubuntu0.26.04.1",
      "released": "2026-04-21T06:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}