CVE-2026-4367: libXpm Out-of-Bounds Read DoS Vulnerability

CVE-2026-4367 Overview

CVE-2026-4367 is an out-of-bounds read vulnerability in libXpm, the X PixMap image format library maintained by the freedesktop.org X.Org project. The flaw resides in the xpmNextWord() function, which fails to validate file boundaries when parsing XPM image data. A local user with low privileges can supply a specially crafted or truncated XPM file to trigger an internal pointer read beyond the end of the file buffer. The resulting memory access causes application crashes and a denial of service condition in any process that uses libXpm to parse untrusted XPM images. The vulnerability is classified under [CWE-125: Out-of-bounds Read].

Critical Impact
Local attackers can crash applications linked against libXpm by supplying malformed XPM image files, producing reliable denial of service against desktop and graphical services.

Affected Products

libXpm from the freedesktop.org X.Org project
Linux distributions packaging vulnerable libXpm versions, including Red Hat Enterprise Linux
Applications and desktop environments that load XPM images through libXpm

Discovery Timeline

2026-06-16 - CVE-2026-4367 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-4367

Vulnerability Analysis

The vulnerability exists in xpmNextWord(), an internal helper that advances a parser pointer across whitespace-delimited tokens inside an XPM file. The function reads bytes sequentially without confirming that the cursor remains within the bounds of the mapped file buffer. When supplied with a malformed or extremely small XPM file, the loop continues past the buffer end and dereferences memory the parser does not own.

Because the read occurs during initial header parsing, exploitation does not require valid pixmap structure or color tables. Any tool, viewer, or service that hands an attacker-controlled XPM byte stream to libXpm is exposed. The impact is limited to availability: confidentiality and integrity are not affected, but the affected process aborts when the read crosses into unmapped or guard pages.

Root Cause

The root cause is missing boundary validation in xpmNextWord(). The parser tracks the current position but does not compare it against the known length of the input before reading the next byte. When the input is shorter than the parser expects, the pointer walks past the file end. The upstream fix lives in freedesktop GitLab commit 5448e1bd, which adds the required length check before each read.

Attack Vector

The attack vector is local and requires low privileges with no user interaction. An attacker authenticated to the system delivers a crafted XPM file to a target that invokes libXpm for parsing. Typical delivery paths include thumbnail generators, icon loaders in window managers, image viewers, and document processors that embed XPM resources. The vulnerability cannot be triggered remotely on its own, but it can be chained into broader attacks against multi-user systems where image processing runs under privileged service accounts.

No verified proof-of-concept code is published for this issue. Technical detail is available in the Red Hat CVE-2026-4367 Advisory and the Freedesktop GitLab Commit.

Detection Methods for CVE-2026-4367

Indicators of Compromise

Repeated SIGSEGV or SIGABRT crashes in processes linked against libXpm.so, especially image viewers, file managers, and thumbnailers.
Unexpected core dumps or systemd-coredump entries referencing xpmNextWord in the stack trace.
Presence of unusually small or truncated .xpm files in user-writable directories, temporary spool paths, or upload locations.

Detection Strategies

Hunt across endpoint telemetry for crash events whose faulting module is libXpm and correlate with the parent process and recently accessed file.
Inspect package inventory to enumerate hosts running libXpm versions prior to the fix introduced in commit 5448e1bd.
Apply file-content inspection to flag XPM files that are smaller than the minimum valid header length or that lack the expected static char * declaration.

Monitoring Recommendations

Forward application crash logs and systemd-coredump events to a centralized log platform for correlation against libXpm versions.
Monitor processes that handle untrusted image content, including mail clients, browsers, and document converters, for abnormal restart loops.
Track outbound delivery of XPM files in network and email gateways to identify pre-positioning of malformed payloads.

How to Mitigate CVE-2026-4367

Immediate Actions Required

Apply the libXpm security update from your Linux distribution as soon as it becomes available; consult the Red Hat CVE-2026-4367 Advisory for Red Hat Enterprise Linux package guidance.
Inventory all systems with libXpm installed, prioritizing multi-user hosts, build servers, and workstations that process user-supplied images.
Restart services and desktop sessions after patching so that updated library code is loaded by all running processes.

Patch Information

The upstream fix is committed to the X.Org libxpm repository in commit 5448e1bd, which adds boundary checks to xpmNextWord(). Distribution maintainers are expected to backport this change into supported libXpm packages. See the Freedesktop GitLab Commit, Red Hat Bug Report #2448984, and the OSS-Sec Mailing List Update for tracking details.

Workarounds

Restrict shell and file-system access on shared hosts to limit which local users can deliver malformed XPM files to privileged processes.
Disable XPM thumbnailers and icon loaders in desktop environments where XPM support is not required.
Sandbox image-processing utilities with seccomp, bubblewrap, or container isolation so that a crash does not affect adjacent services.

bash

# Configuration example: identify and update libXpm on RHEL-based systems
rpm -q libXpm
sudo dnf check-update libXpm
sudo dnf update libXpm
# Verify the loaded library version after update
ldconfig -p | grep libXpm