UBUNTU-CVE-2026-120434: Buffer Overflow
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly() function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack array to crash the converter or potentially execute code.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Ubuntu netpbm-free package are exposed if they use picttoppm to process untrusted PICT files. An attacker needs to get a crafted PICT file processed by the converter; user interaction is required according to the supplied severity vector.
What input is needed to trigger the overflow?
The crafted PICT file must contain polygon edges that cause scanPoly() to generate more than 5,000 points. This overflows the coord stack array and can crash picttoppm or potentially permit code execution.
Which Netpbm releases contain the vulnerability?
Affected releases are Netpbm versions before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08.
What can be done if an update cannot be applied immediately?
Avoid processing untrusted PICT files with picttoppm until an update is available. Restricting access to the converter and isolating workflows that must process PICT input can reduce exposure.