DEBIAN-CVE-2026-120432: Integer Overflow
Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16t loop counters into negative row buffer indices to cause crashes or potential code execution.
Affected Software
Event History
Frequently Asked Questions
What attacker interaction is required to trigger this issue?
An attacker must provide a crafted ICO or CUR icon file to winicontopam. The file needs an oversized width or height above 32767 to trigger the int16_t loop-counter wraparound.
Are normal-sized icon files affected?
The described flaw depends on ICO/CUR dimensions above 32767. The provided information does not indicate that ordinary dimensions trigger the vulnerable path.
What can happen if the vulnerable converter processes a malicious file?
The integer overflow can produce negative row-buffer indices and corrupt heap memory. This can cause a crash or potentially allow code execution.
Which Netpbm releases contain the issue?
The issue affects Netpbm releases before 10.86.51, 11.02.30, and 11.15.08. The affected Debian software entry is debian/netpbm-free.