UBUNTU-CVE-2026-120432: Integer Overflow
Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16t loop counters into negative row buffer indices to cause crashes or potential code execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Ubuntu systems using the netpbm-free package are exposed when winicontopam processes an attacker-controlled ICO or CUR file. The attack requires local access and user interaction, but no privileges are required.
What does an attacker need to provide?
The attacker needs a crafted icon file with an ICO/CUR width or height greater than 32767. Processing that file with winicontopam can cause int16_t loop counters to wrap and use negative row-buffer indices.
How can I check whether my installed version is affected?
Check the installed Netpbm version used by netpbm-free. Versions before 10.86.51, 11.02.30, or 11.15.08 are affected; use the applicable fixed release or a newer version.