---------- Forwarded message --------- From: Olivier Fourdan <[email protected]> Date: Tue, Apr 21, 2026 at 3:15 PM Subject: X.Org Security Advisory: CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord() To: <[email protected]> Cc: <[email protected]>, xorg-devel <[email protected]>, <[email protected]>
====================================================================== X.Org Security Advisory: April 21, 2026 Issue in libXpm prior to version 3.5.19 ====================================================================== An issue has been found in the libXpm library published by X.Org for which we are releasing a security fix for in libXpm-3.5.19. * CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord() libXpm uses a number of internal helper functions to parse the XPM file format. One of these internal functions, xpmNextString(), checks for the NULL terminator when looking for the end of the current string but not when looking for the beginning of the next string. A small XPM file with a malformed color table definition may cause the function xpmNextWord(), called from xpmParseColors() following a call to xpmNextString(), to start past the actual end of the file, causing an out-of-bound read. Introduced in: Unknown, prior to 3.5.5 (from Xorg 7.1) Fixed in: libXpm-3.5.19 Fix: https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/5448e1bd Found by: Naoki Wakamatsu
-----BEGIN PGP PUBLIC KEY BLOCK----- xsDiBERd0h4RBACflXMwRMuZ/gICB7oM/SwnYMoDeRVaZHYT2RtI6iaNQpovoMas fbLX31icweQm9sMLQJR/bNABpp28Fs1S4yNt9SwAProigexyWl3fFE3uqoVRmglZ uQdyXl7nnPC7A3hxHPX88tsZS4UlLFRssTjNnrzzhSR3xyyIlOJnmG5pJwCg/yaH DECRtdWm9gIJZwfM6S+ANYUD/0s6FPCIdbDqCzNcMH7YZID+JjBOU3VlRdXfzGmx Iy2aPBpC9pkb0EUEL94QZ5Ysa1EGNnNUPq8dQWOr/NllCt2/l0HDLGoziBCpBTvG ZNnFaJoErG0kmCH2u0w9VmKKSBq6C0sI8rFW1JthKc/bu6ucBKKbpi4sFYAMyZHn sNbzA/9VYevyns5TmZeR7t+x8YRj6xZxWVNGm20gnBBhHVnq/EGIn4a/YN1NLFNc 4EuarFnzl0w6L1IQHanM+ajBJgzL4oSYCufhTSXgA2utrpIRtKkRW9JH6zt3J5hk W8oIcEsY3YRKQ3iVKS3Kz8PgSwezNewFT6o3Juu//95O5qSm8s0iT2xpdmllciBG b3VyZGFuIDxmb3VyZGFuQHhmY2Uub3JnPsJ6BBMRAgA6AhsjBgsJCAcDAgQVAggD BBYCAwECHgECF4ACGQEWIQRn3IbyYj/F/Uu1Il0UcG2+HktFQAUCXx7jggAKCRAU cG2+HktFQMAMAJ4kmAtOA9YEazO+1TNxEvEDZbEDSwCfUVR27NAtNegGOMO7piF1 KrurTenCYwQTEQIAIwUCRF3SHgUJCWYBgAYLCQgHAwIEFQIIAwQWAgMBAh4BAheA AAoJEBRwbb4eS0VA8+wAoJi6ZBRk43FBp8154yMNO9SUItB0AJ4rDBZ6dJAUCKnb 9pbn2fWMV2YQ98JpBBMRAgApAhsjBgsJCAcDAgQVAggDBBYCAwECHgECF4AFCRpU HdIFAkajy3QCGQEACgkQFHBtvh5LRUA0hwCff1hwCeEucHWkhFAO4EiIiGEUxJwA oNlgcwHVYhqSesplI6ePAoEfDac5zSVPbGl2aWVyIEZvdXJkYW4gPG9mb3VyZGFu QHJlZGhhdC5jb20+wncEExECADcCGyMGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgBYh BGfchvJiP8X9S7UiXRRwbb4eS0VABQJfHuODAAoJEBRwbb4eS0VAwOoAn1jPsEMW v/z9pqvw2We5FDLbi0ncAJ9WbA5E1fHh8m31NdSyFy2tXt8wfcJmBBMRAgAmBQJG o8g5AhsjBQkJZgGABgsJCAcDAgQVAggDBBYCAwECHgECF4AACgkQFHBtvh5LRUAL GQCgmvZZoMKZC81KV+HGlmYvy/CkivAAnj4rIzP4L/dAFXftAa9BvfMoSw/SwmYE ExECACYCGyMGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgAUCRqPLWAUJGlQd0gAKCRAU cG2+HktFQKczAKDeq33Q9kYEKPAL5FdFAfX5HOdbMQCgrJ1XMhV5ELa+QYhFTH6T mNfffejNI09saXZpZXIgRm91cmRhbiA8Zm91cmRhbkBnbWFpbC5jb20+wncEExEC ADcCGyMGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgBYhBGfchvJiP8X9S7UiXRRwbb4e S0VABQJfHuODAAoJEBRwbb4eS0VAnkYAn3JimwxnmhYjwq/WoZ/QyVFFmDFMAJ4v QFng2LaebkTG6/YInF5P8qlwncJmBBMRAgAmBQJGo8gKAhsjBQkJZgGABgsJCAcD AgQVAggDBBYCAwECHgECF4AACgkQFHBtvh5LRUBydACfba08blV5kvAdN/mSKD1N gAHsiIcAoPbpCWW3IUiZ/1T9v8YTuDbtLWkLwmYEExECACYCGyMGCwkIBwMCBBUC CAMEFgIDAQIeAQIXgAUCRqPLWAUJGlQd0gAKCRAUcG2+HktFQISoAJ9ybOFFTByE yt24KXBAlesX7qBIlACgmWtgSW3ZzoGwJXG0knERqSPDDDzOwU0ERF3SSRAIAI0c lctVOjdLUtE1ZRYS7Reu/oXSPns8duS4CLHmknF3kgn8uN6L6fptwFzh3yizCMGv Td4YA4/NimzsQxXmar9fDRg/VHEPsaHrWanE3VPMxBoRyPtnNeQtQXrRb8XCZllo GvmYQ/CZ8N9IaUq/Q8bbpqyr+dJy/gy+gc0aCxPdZhghxvOKrcJZg7zks52cQegz Tne6rjU0o/eTeySkWgboL4RaLQndUVX7LJ1UgL3mxr30fgv6JxmN8YkD6lSbb8+i vXhHX8LNuY8wmX+tCIrlm+20hpWtLEyB3HSnqgyC7Y1v0ZPYmQaRm1AQcafikFml 9CieH9DaV6avfPQLkgsAAwUH/2BX9xYtFY85fSKP7Kz0ClcCHpuweIkmTbPWDT91 HQmf2dRbzI88CV3ZzawJMJHHL1Nua7CGNX1Z+cFJz4QTkyAOXXNlbHaVRXF2Epnw FfjF5UM/D5j3YiUhXoam1LKz8/VRw3ZDDdc349jKPJEWNEmqs9NeGhSC2YsL2TsO BaBzWPvRXS1otPCaKOTuDa9h2T8om2SEvqvJjd0jdC0o4khJ8zsYtE3vZBXbyfdf cn5ktWedyEt6lcRMI04bvu2+j6B68GwtVDNr/RHaDPd+UkbZSHwiRoxGkRUQttYv Lh/NrtLo8a6NQFWAePMM8nU2P7n6AcRf357nqbwnQWJ/TyvCXQQYEQIAHRYhBGfc hvJiP8X9S7UiXRRwbb4eS0VABQJfHuPcAAoJEBRwbb4eS0VAnL4Anim4vNYyrDc8 NTdS3mgWGtdXVjWdAKCjUhzkN3uCaYNJR6h0Y1thYuPEJA== =cxyl -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE----- wmMEABEIACMWIQRn3IbyYj/F/Uu1Il0UcG2+HktFQAUCaed4VAUDAAAAAAAKCRAUcG2+HktFQODs AKCsyiHWA1t2tuSLtqjXH7U89MYVzQCfQLWT63GO99+M6qjdWHXTvxcPytA= =t1IC -----END PGP SIGNATURE-----
