CVE-2026-112275: Netpbm through 11.16.00 Heap Out-of-Bounds Write via rasttopnm pr_load_image
Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder prloadimage in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past mdimage, causing memory corruption and crashes.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger this issue?
They must cause rasttopnm to process a specially crafted byte-encoded Sun rasterfile. The file uses tiny dimensions and an excessively long run-length-encoded body to write controlled bytes past the md_image heap buffer.
Which environments are realistically exposed?
Systems are exposed where untrusted Sun rasterfiles can be supplied to, or automatically processed by, rasttopnm. The vector is local and requires user interaction, so an attacker needs a user or workflow to open or process the malicious file.
What is the likely impact of successful exploitation?
The out-of-bounds heap write can corrupt memory and cause crashes. The reported impact includes integrity loss and high availability impact; confidentiality impact is not indicated.
How can I determine whether I may be affected?
Check whether Netpbm is installed at version 11.16.00 or earlier and whether rasttopnm is used to process Sun rasterfiles, particularly from untrusted sources. Review automated image-conversion pipelines as well as user-driven file processing.