CVE-2026-94287 x.org CVE debrief

Who should care

Defenders responsible for systems using libXpm should assess exposure and prioritize verification and updates to prevent potential denial of service attacks.

Why it matters

Defenders should prioritize verifying and updating libXpm to version 3.5.19 or later to prevent potential denial of service attacks, as a denial of service via unsigned underflow in libXpm's write path could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

• Potential denial of service attacks could cause unbounded CPU usage and memory exhaustion
• Defenders should verify and update libXpm to version 3.5.19 or later to prevent potential attacks
• System resources should be monitored for signs of potential denial of service attacks

Technical summary

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion. The vulnerability is due to an unsigned underflow in the write path of libXpm, which can be exploited by local attackers. This issue affects libXpm versions prior to 3.5.19, and defenders should prioritize verifying and updating libXpm to version 3.5.19 or later to prevent potential denial of service attacks.

Defensive priority

Defenders should prioritize verifying and updating libXpm to version 3.5.19 or later to prevent potential denial of service attacks.

Recommended defensive actions

• Verify libXpm version and update to 3.5.19 or later
• Monitor system resources for signs of potential denial of service attacks
• Implement compensating controls to limit the impact of potential attacks

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being the CVE Program record and NVD vulnerability detail page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.