CVE-2010-2528: The clientautoresp function in family_icbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7...

Security readout for executives and security teams

This vulnerability can let an authenticated remote user crash vulnerable Pidgin clients. It affects the libpurple Oscar protocol plugin in Pidgin versions before 2.7.2 when handling malformed X-Status messages. The reported impact is denial of service, not data theft or system takeover. Exposure is limited to environments running Pidgin or libpurple before 2.7.2 with the oscar protocol plugin in use. Organizations with legacy desktops or bundled messaging clients should check installed packages and distribution backports. Treat as a legacy client reliability risk. It is unlikely to justify emergency response unless affected messaging clients are still operationally important, but outdated Pidgin/libpurple installations should be removed or updated. Mitigation focus: Upgrade Pidgin or libpurple to 2.7.2 or a vendor-fixed package.; Check distribution advisories for backported fixes on packaged builds.; Disable or avoid the oscar plugin until patched where feasible..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.