untrusted comment: verify with openbsd-78-base.pub
RWS3/nvFmk4SWdX7gibDnBCMra6uFt/1DuP6H0dycb9uXZdWyMpsmtIrdZ+DkndNuNriIsnQuM4qBR2gy3pmbE8TICJccAl0mgE=

OpenBSD 7.8 errata 032, April 21, 2026:

libXpm out-of-bounds read.  CVE-2026-4367

Apply by doing:
    signify -Vep /etc/signify/openbsd-78-base.pub -x 032_libxpm.patch.sig \
        -m - | (cd /usr/xenocara && patch -p0)

And then rebuild and install libXpm:
    cd /usr/xenocara/lib/libXpm
    make -f Makefile.bsd-wrapper obj
    make -f Makefile.bsd-wrapper build

Index: lib/libXpm/src/data.c
===================================================================
RCS file: /cvs/xenocara/lib/libXpm/src/data.c,v
diff -u -p -r1.6 data.c
--- lib/libXpm/src/data.c	3 Oct 2023 15:55:58 -0000	1.6
+++ lib/libXpm/src/data.c	13 Apr 2026 11:07:17 -0000
@@ -210,6 +210,9 @@ xpmNextString(xpmData *data)
 	    while ((c = *data->cptr++) && c != data->Bos && c != '\0')
 		if (data->Bcmt && c == data->Bcmt[0])
 		    ParseComment(data);
+
+	    if (c == '\0')
+		return XpmFileInvalid;
 	} else if (data->Bcmt) {	/* XPM2 natural */
 	    while (((c = *data->cptr++) == data->Bcmt[0]) && c != '\0')
 		ParseComment(data);
Index: lib/libXpm/src/parse.c
===================================================================
RCS file: /cvs/xenocara/lib/libXpm/src/parse.c,v
diff -u -p -r1.9 parse.c
--- lib/libXpm/src/parse.c	7 May 2023 16:07:43 -0000	1.9
+++ lib/libXpm/src/parse.c	13 Apr 2026 11:07:17 -0000
@@ -221,7 +221,9 @@ xpmParseColors(
 
     if (!data->format) {		/* XPM 2 or 3 */
 	for (a = 0, color = colorTable; a < ncolors; a++, color++) {
-	    xpmNextString(data);	/* skip the line */
+	    ErrorStatus = xpmNextString(data);         /* skip the line */
+	    if (ErrorStatus != XpmSuccess)
+		goto error;
 
 	    /*
 	     * read pixel value
