CVE-2026-94287
Medium · 5.5CVSS
5.5
EPSS
0.1%
Published
Sep 28, 2026
CISA due date
—
The record
A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-85977 A flaw was found in libtirpc. CWE-1050
- CVE-2026-81736 If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried… CWE-1050
- CVE-2026-52681 Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid… CWE-1050
- CVE-2026-71488 league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. CWE-1050
- CVE-2026-48779 ws is an open source WebSocket client and server for Node.js. CWE-1050
- CVE-2026-44390 NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling… CWE-1050
- CVE-2026-41292 NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of… CWE-1050
- CVE-2026-4634 A flaw was found in Keycloak. CWE-1050