CVE-2026-94287

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-28

Last updated on: 2026-09-29

Assigner: SUSE

Description

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-29

Generated

2026-10-18

AI Q&A

2026-09-28

EPSS Evaluated

2026-10-16

NVD

CVE-2026-94287

EUVD

EUVD-2026-88179

Affected Vendors & Products

Vendor	Product	Version / Range
x.org	libXpm	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1050	The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.

Attack-Flow Graph

Executive Summary

This is a denial of service vulnerability in libXpm's write path before version 3.5.19. It involves an unsigned underflow issue that allows local attackers to trigger unbounded CPU usage and memory exhaustion.

Detection Guidance

This vulnerability involves a denial of service via unsigned underflow in libXpm's write path. Detection requires checking the version of libXpm installed on your system. If it is before 3.5.19, the system is vulnerable. Use commands like 'rpm -q libXpm' for RPM-based systems or 'dpkg -l libxpm4' for Debian-based systems to check the version.

Impact Analysis

If exploited, this flaw could cause your system to become unresponsive or crash due to excessive CPU and memory consumption. It requires local access but could disrupt normal operations.

Compliance Impact

This vulnerability causes unbounded CPU usage and memory exhaustion through a denial of service attack. Such resource exhaustion could potentially impact systems handling sensitive data, but direct compliance impacts depend on system configuration and data processing contexts rather than the vulnerability itself.

Mitigation Strategies

Update libXpm to version 3.5.19 or later to address the denial of service vulnerability caused by unsigned underflow in the write path.

Hi! I’m here to help you understand CVE-2026-94287. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70