A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-94287.json"