Vulnerability Spotlight: Pidgin Vulnerabilities

Summary: Cisco Talos disclosed 16 vulnerabilities in how the Pidgin chat client handles the MXit protocol, including six denial-of-service flaws, four information leaks, and code execution issues tracked as CVE-2016-2365 through CVE-2016-4323. The flaws stem from missing field validation, unchecked lengths, and out-of-bounds reads, and can be triggered by a malicious server or an attacker intercepting network traffic.
Bottom line: Pidgin runs on millions of systems, and several of these flaws let a malicious or man-in-the-middle server leak memory contents back to itself or execute code, so an unpatched client is exposed to whoever controls the connection.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2016-2365 CVE-2016-2366 CVE-2016-2367 CVE-2016-2368 CVE-2016-2369 CVE-2016-2370 CVE-2016-2371 CVE-2016-2372 CVE-2016-2373 CVE-2016-2374 CVE-2016-2375 CVE-2016-2376 CVE-2016-2377 CVE-2016-2378 CVE-2016-2380 CVE-2016-4323
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026