CVE-2026-120433: Buffer Overflow

Q: Which Netpbm versions are affected?

Affected versions are releases before 10.86.51, 11.x releases before 11.02.30, and 11.03 releases before 11.15.08.

Q: What must an attacker provide to trigger the issue?

An attacker must cause processing of a crafted PICT file containing a polygon with more than 100 points. The vulnerable code is the picttoppm paintPoly() function.

Q: Which systems are realistically exposed?

Systems using the affected Netpbm packages that process attacker-controlled or otherwise untrusted PICT files are exposed. The listed affected software includes ubuntu/netpbm-free and debian/netpbm-free.

Published Nov 2, 2026

Updated

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.

Affected Software

11 affected components

debian/netpbm-free*

debian/netpbm-free<=2:11.01.00-2, <=2:11.10.02-1, <=2:11.13.03+ds-2

ubuntu/netpbm-free*

Event History

Nov 2, 2026

CVE Published

via NVD·03:17 PM

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Netpbm versions are affected?

Affected versions are releases before 10.86.51, 11.x releases before 11.02.30, and 11.03 releases before 11.15.08.

What must an attacker provide to trigger the issue?

An attacker must cause processing of a crafted PICT file containing a polygon with more than 100 points. The vulnerable code is the picttoppm paintPoly() function.

Which systems are realistically exposed?

Systems using the affected Netpbm packages that process attacker-controlled or otherwise untrusted PICT files are exposed. The listed affected software includes ubuntu/netpbm-free and debian/netpbm-free.

CVE-2026-120433: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which Netpbm versions are affected?

What must an attacker provide to trigger the issue?

Which systems are realistically exposed?

Company

Resources

Contact

Frequently Asked Questions

Which Netpbm versions are affected?

What must an attacker provide to trigger the issue?

Which systems are realistically exposed?