libXpm CVE-2026-94287

Exploitation requires a victim application linked against libXpm (before 3.5.19) to invoke the XPM write/save code path on attacker-influenced data - i.e. the flaw is in the write path, so a workflow that writes or converts to XPM format is the specific trigger. Limiting factors: the vector is local (AV:L) and requires user interaction (UI:R) - the victim must actively process the crafted input; there is no remote/network trigger and no authentication is bypassed. Impact is confined to denial of service (CPU/memory exhaustion) with no data exposure or code execution.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a local, low-complexity, availability-only denial of service that requires user interaction and yields no confidentiality or integrity impact. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input - so per available signals this is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The impact is strictly resource exhaustion (unbounded CPU and memory), not code execution, despite libXpm's history of memory-safety CVEs. Note a nuance to verify: PR:N with UI:R means no attacker credentials are needed, but a victim must actively process/write an attacker-controlled XPM through an application linked against libXpm - the 'local' vector reflects that the malicious input is fed to a local process, not remote network reachability. Bottom line: real fix worth applying via distro updates, but not an urgent, widely-weaponizable threat.

An attacker crafts a malicious XPM image that, when a victim opens or converts it in an application using libXpm's write path (e.g. an image viewer/converter saving to XPM), triggers an unsigned integer underflow that drives an unbounded loop. The victim's process consumes runaway CPU and exhausts memory, hanging or crashing the application or starving the host. No public proof-of-concept is identified in the provided data.