CVE-2026-120431: Buffer Overflow

Q: What must an attacker do to exploit this issue?

An attacker must get a crafted RLE-compressed SGI image processed by sgitopnm. The image uses oversized offset table lengths to cause controlled data to be written past a heap buffer.

Q: Which Netpbm releases are affected?

Affected releases are Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07. The listed affected software packages are ubuntu/netpbm-free and debian/netpbm-free.

Q: What is the likely impact if exploitation succeeds?

Processing a malicious file can crash the affected program or potentially allow code execution. The vulnerability affects confidentiality, integrity, and availability according to the supplied severity vector.

Published Nov 2, 2026

Updated

Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution.

Affected Software

11 affected components

debian/netpbm-free*

debian/netpbm-free<=2:11.01.00-2, <=2:11.10.02-1, <=2:11.13.03+ds-2

ubuntu/netpbm-free*

Event History

Nov 2, 2026

CVE Published

via NVD·03:17 PM

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker must get a crafted RLE-compressed SGI image processed by sgitopnm. The image uses oversized offset table lengths to cause controlled data to be written past a heap buffer.

Which Netpbm releases are affected?

Affected releases are Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07. The listed affected software packages are ubuntu/netpbm-free and debian/netpbm-free.

What is the likely impact if exploitation succeeds?

Processing a malicious file can crash the affected program or potentially allow code execution. The vulnerability affects confidentiality, integrity, and availability according to the supplied severity vector.

CVE-2026-120431: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

Which Netpbm releases are affected?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Which Netpbm releases are affected?

What is the likely impact if exploitation succeeds?