What’s Vulnerable › Vulnerabilities

CVE-2023-43788: Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-10 · updated 2026-06-17
• Weakness: CWE-125

Description

A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system.

Affected products

• Fedoraproject Fedora: 37, 38, 39
• Red Hat Enterprise Linux: 8.0, 9.0
• libXpm: before 3.5.17 — fixed in 3.5.17

How to fix

Upgrade to a fixed version: libXpm 3.5.17. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2024:2146
• https://access.redhat.com/errata/RHSA-2024:2217
• https://access.redhat.com/errata/RHSA-2024:2974
• https://access.redhat.com/errata/RHSA-2024:3022
• https://access.redhat.com/security/cve/CVE-2023-43788
• https://bugzilla.redhat.com/show_bug.cgi?id=2242248
• https://access.redhat.com/errata/RHSA-2024:2146
• https://access.redhat.com/errata/RHSA-2024:2217
• https://access.redhat.com/errata/RHSA-2024:2974
• https://access.redhat.com/errata/RHSA-2024:3022
• https://access.redhat.com/security/cve/CVE-2023-43788
• https://bugzilla.redhat.com/show_bug.cgi?id=2242248

Get alerted when CVE-2023-43788 or the next vulnerability affects your stack