CVE-2026-120437: Medium severity debian/netpbm-free vulnerability

Q: Who is exposed to this issue?

Systems that use the tgatoppm converter to process attacker-supplied color-mapped Targa files are exposed. The affected software listings include Ubuntu and Debian netpbm-free packages.

Q: What does an attacker need to exploit it?

An attacker needs to provide a crafted color-mapped Targa file with pixel values that exceed the declared color map bounds, and have that file processed by tgatoppm. The supplied vector indicates local attack access and user interaction is required.

Q: What is the impact of successful exploitation?

Processing the crafted file can crash the converter or cause adjacent memory to be included in the output image. The stated impact includes limited confidentiality impact and high availability impact.

Q: Which upstream versions contain the fix?

The issue affects Netpbm versions before 10.86.51, 11.x versions before 11.02.30, and 11.03 versions before 11.15.08. Versions at or beyond the applicable listed fix version are not described as affected.

Published Nov 2, 2026

Updated

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's getpixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values exceed the declared color map bounds to crash the converter or leak adjacent memory into the output image.

Affected Software

11 affected components

debian/netpbm-free*

debian/netpbm-free<=2:11.01.00-2, <=2:11.10.02-1, <=2:11.13.03+ds-2

ubuntu/netpbm-free*

Event History

Nov 2, 2026

CVE Published

via NVD·03:17 PM

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems that use the tgatoppm converter to process attacker-supplied color-mapped Targa files are exposed. The affected software listings include Ubuntu and Debian netpbm-free packages.

What does an attacker need to exploit it?

An attacker needs to provide a crafted color-mapped Targa file with pixel values that exceed the declared color map bounds, and have that file processed by tgatoppm. The supplied vector indicates local attack access and user interaction is required.

What is the impact of successful exploitation?

Processing the crafted file can crash the converter or cause adjacent memory to be included in the output image. The stated impact includes limited confidentiality impact and high availability impact.

Which upstream versions contain the fix?

The issue affects Netpbm versions before 10.86.51, 11.x versions before 11.02.30, and 11.03 versions before 11.15.08. Versions at or beyond the applicable listed fix version are not described as affected.

CVE-2026-120437: Medium severity debian/netpbm-free vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

Which upstream versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

Which upstream versions contain the fix?