DEBIAN-CVE-2026-120437: Medium severity debian/netpbm-free vulnerability
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's getpixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values exceed the declared color map bounds to crash the converter or leak adjacent memory into the output image.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that use the tgatoppm converter from an affected Netpbm release are exposed when they process attacker-controlled color-mapped Targa files. The issue is in the Debian netpbm-free package.
What does an attacker need to exploit it?
An attacker needs to provide a crafted color-mapped Targa file containing pixel values that exceed the file's declared color map bounds. User interaction is required to have the file processed by tgatoppm.
What is the impact of successful exploitation?
Processing the crafted file can crash the converter or cause adjacent memory to be included in the generated output image. The stated impact includes loss of availability and exposure of memory contents.
Which Netpbm versions contain the vulnerable behavior?
The issue affects Netpbm releases before 10.86.51, 11.x releases before 11.02.30, and 11.03 releases before 11.15.08.