CVE-2016-2365

What it actually does

Specially crafted MXIT protocol data processed by Pidgin triggers a null pointer dereference that terminates the client process.

Why it matters to the business

Instant-messaging users experience sudden application crashes, interrupting conversations and requiring restarts until the malicious traffic stops.

How an attack unfolds

An attacker who can intercept or impersonate an MXIT server sends invalid protocol data over the network; Pidgin's handler dereferences a null pointer and crashes, achieving a denial of service without any user interaction.

How to fix it

Upgrade Pidgin to a version that removes the MXIT protocol handler or disable the MXIT account type entirely; replace MXIT usage with supported protocols.

How to confirm the fix worked

Confirm the installed Pidgin version is newer than the vulnerable releases, review protocol configuration to ensure MXIT is disabled, and test connectivity with a benign MXIT server to verify absence of crashes.

Typical attack path

1. Gain network position to intercept or spoof MXIT server responses
2. Transmit malformed MXIT protocol packets to the Pidgin client
3. Trigger null pointer dereference inside the MXIT handling code
4. Force the Pidgin process to terminate

How to detect it

Search Pidgin crash logs and system event logs for abrupt terminations immediately following MXIT network activity; correlate with network captures containing MXIT protocol frames.

What your security team should do

• Disable the MXIT protocol in all Pidgin deployments immediately
• Remove or replace Pidgin installations that still rely on MXIT
• Monitor for any remaining MXIT traffic in network logs