USN-8600-1: libXpm vulnerability

unknownCVE-2026-4367

Naoki Wakamatsu discovered that libXpm did not properly validate file boundaries when processing XPM image files. An attacker could possibly use this issue to cause libXpm to crash, resulting in a denial of service.

CSIRTS triage

vendor: null product: libXpm Denial of serviceaffected: null

What: Improper validation of file boundaries can cause libXpm to crash.
Who is affected: Users of libXpm.
Urgency: Remediation is needed to avoid denial of service incidents.
Action: Update libXpm to a patched version.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch libXpm

Get an email when a new libXpm advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-23
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8600-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-43670.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-4367	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.