DEBIAN-CVE-2026-120435: Buffer Overflow

Published Nov 2, 2026

Updated

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte colorName hash entries, causing crashes or potentially code execution.

Affected Software

3 affected components

debian/netpbm-free*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade netpbm to a version that resolves this vulnerability.
Fixed in 10.86.51
Upgrade
Upgrade netpbm to a version that resolves this vulnerability.
Fixed in 11.02.30
Upgrade
Upgrade netpbm to a version that resolves this vulnerability.
Fixed in 11.15.08

Event History

Nov 2, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates local access and user interaction are required, while no privileges are required. Exploitation involves getting a user or local processing workflow to handle a crafted XPM file.

Which Netpbm releases are affected?

Affected releases are versions before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08. Systems using the Debian netpbm-free package should determine the Netpbm version provided by their installed package.