CVE-2016-2367: An information leak exists in the handling of the MXIT protocol in Pidgin.

Security readout for executives and security teams

Pidgin 2.10.11 can mishandle malformed MXIT avatar data. An attacker positioned as a malicious user, server, or man-in-the-middle could cause a crash or leak process memory into an avatar file that may later be shared. Business urgency depends on whether MXIT support is used in your environment. Exposure appears limited to systems running affected Pidgin versions with MXIT protocol handling reachable or configured. Organizations without Pidgin, without MXIT use, or using patched distribution packages are less likely exposed. Treat this as a targeted legacy-client risk, not a broad enterprise emergency. Act promptly where Pidgin with MXIT is installed, especially on endpoints handling sensitive communications or operating on untrusted networks. Mitigation focus: Inventory Pidgin installations and identify version 2.10.11 exposure.; Apply Pidgin or operating system security updates from vendor advisories.; Disable or remove MXIT account support where it is not required..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.