Hi,

The following vulnerability was published for libxpm.

CVE-2026-94287[0]:
| A denial of service via unsigned underflow in libXpm's write path in
| libXpm before 3.5.19 could be used by local attackers to cause
| unbounded CPU usage and memory exhaustion.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-94287
https://www.cve.org/CVERecord?id=CVE-2026-94287
[1] https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/32
[2] https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/6e42eb9e105ae17318f3ba5656d94cd3f80eeaa3

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libxpm, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149666@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emilio Pozuelo Monfort <pochu@debian.org> (supplier of updated libxpm package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 26 Oct 2026 20:00:13 +0100
Source: libxpm
Architecture: source
Version: 1:3.5.20-1
Distribution: unstable
Urgency: medium
Maintainer: Debian X Strike Force <debian-x@lists.debian.org>
Changed-By: Emilio Pozuelo Monfort <pochu@debian.org>
Closes: 1149666
Changes:
 libxpm (1:3.5.20-1) unstable; urgency=medium
 .
   * New upstream release (closes: #1149666)
     - CVE-2026-94287: DoS via unsigned underflow in libXpm's write path.
   * Update signing-key.asc.
Checksums-Sha1:
 645d440621c07f022a435ffa95751df62b5b6fc7 1998 libxpm_3.5.20-1.dsc
 62ecf25dd03e311c2ac4e45572518780624fa291 693398 libxpm_3.5.20.orig.tar.gz
 afbdc33a82aceb137ff50c2f34e2baf7f31ae485 55200 libxpm_3.5.20-1.diff.gz
 0ddd9ce39a145d90e636c1d57c6761bb1f0247df 6450 libxpm_3.5.20-1_source.buildinfo
Checksums-Sha256:
 389d0ca69ae0dc19da2a9f8bead36e18d331b290426329b527bf1b7f3dbcc1dc 1998 libxpm_3.5.20-1.dsc
 736704d843459abbf769560ff8e443a5de4e6023082e7086c9d195253ada17ff 693398 libxpm_3.5.20.orig.tar.gz
 e0806159a6fd163bbaa12ae969b7986e3510fa5363c8515465aa29473098698d 55200 libxpm_3.5.20-1.diff.gz
 ca28c2429480af5c8b9502c58ce6217e8d7c9d9825f74327a992ac43d68a8644 6450 libxpm_3.5.20-1_source.buildinfo
Files:
 c13dfc679758b9ded24790df11ebac1c 1998 x11 optional libxpm_3.5.20-1.dsc
 2ed77dfd7d258e8bcc2860d83b9621f1 693398 x11 optional libxpm_3.5.20.orig.tar.gz
 ac7f813a542bfdfe45cdbe6180ca463a 55200 x11 optional libxpm_3.5.20-1.diff.gz
 e3b0066c8538e668146e25d787ff64ca 6450 x11 optional libxpm_3.5.20-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAmrgUnwACgkQnUbEiOQ2
gwIdlg//cZDYovAfywPvMmUcKMAJX1hlHFFCtpxxqXnLgPCJt4NzQtkYr/blm8JX
eVjGUNdlppjobv5ANCgG3aQ4w9eZ0TXxAi3lzNcYUh1fPQ95Ubtlc6/R+wHtz092
gDO/8oQMGKn2tPKgvTxzqvg9ax9UwPLwx5G1sTFBOMOfzQnlekxh0B0+TdPEQIhQ
eWqss0m2Qdhitf8LPBjfU/KqxAHier1fodPcXXqji5MV0kATw5liUe8BnyFsGSo9
4p5J9/pdJe3wIi03cJ2Jt4v4UIf1kMMGlyQjD609M/2CQzh4YwHT4mtUvdObGeVO
jh5RL8yKFX09QuVK+CNpugkRC5TGXuLJ08Z7IwIznEtnmxxwxapqKt++qWBR/sFy
iKsofcnWw1LMPKjbdtSAPoQFVIvYf0aNzddfujnJwW+1sx2aSm7ovGhxmYwtT9+J
JkY+lyJo2ggSADwE7f0GEE6/Z/O7FtZmN3ArjqFFWzfSKAui310JHReBVg54bo98
nKKbrtjd+HQms66PJt5PXP1ECJ/xcUnKGNMOv9RgeNj3UjhptCH7UVpu9Mtlqgm3
L6TR3IjVt0zRCyYKmRH7tfTQEy/4DPyYDpG2zoTnzkYb+/nUWORLkPZdAsr9D7qC
3xiCKk7nialyaqI6ll+c3rpzfNBDt+N8Ndn+gIC+HymthX5LzLA=
=Uh8G
-----END PGP SIGNATURE-----