DEBIAN-CVE-2026-120431: Buffer Overflow
Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution.
Affected Software
Event History
Frequently Asked Questions
What attacker access is required to exploit this issue?
The attacker needs to get a user or process to open a crafted RLE-compressed SGI image with sgitopnm. The supplied vector indicates local attack access, no privileges required, and user interaction required.
Which SGI files are relevant to exposure?
The vulnerable path is sgitopnm's readChannels() handling of RLE-compressed SGI images. The crafted file uses an oversized offset-table length to cause a heap-based buffer overflow.
What versions need remediation?
Affected versions are Netpbm before 10.86.51, versions in the 11.x line before 11.02.29, and version 11.03 before 11.15.07.