This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-94287 →
UBUNTU-CVE-2026-94287
A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usag...
Original description
The description as published by the source.
A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:14.04:LTS
libxpm
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:14.04:LTS
motif
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:16.04:LTS
libxpm
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:16.04:LTS
motif
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS
libxpm
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
motif
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
libxpm
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
motif
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
libxpm
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.12-1ubuntu0.22.04.4"}]}]
Ubuntu:22.04:LTS
motif
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
libxpm
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1ubuntu0.24.04.2"}]}]
Ubuntu:24.04:LTS
motif
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
motif
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
libxpm
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.17-1ubuntu0.26.04.2"}]}]
Ubuntu:26.04:LTS
motif
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- advisory ubuntu.com
- report ubuntu.com
- report cve.org
- report gitlab.freedesktop.org