Pidgin

Pidgin is a widely deployed open-source instant-messaging client and its underlying libpurple library that consolidates multiple chat protocols into a single application, positioning it as a critical component in the messaging supply chain despite a narrow product portfolio. Vulnerabilities affecting the vendor recur through input-validation and memory-safety weakness classes—including improper input validation, buffer-boundary violations, and out-of-bounds reads—that are characteristic of protocol parsing in a multi-protocol abstraction layer. The exposure also includes instances of sensitive-information disclosure, reflecting the complexity of handling credentials and session state across heterogeneous messaging backends. A moderate tendency toward public exploit availability underscores the appeal of messaging clients as targets for credential theft and code execution, and defenders should treat Pidgin updates as important for desktop and embedded deployments where the client sees use. Current exploitation activity and exposure counts are shown alongside this summary.