{"id":"CVE-2026-112275","kind":"vulnerability","aliases":["CVE-2026-112275"],"related":[],"title":"Netpbm: crafted Sun rasterfile input corrupts heap memory in rasttopnm","description":"Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr_load_image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past md_image, causing memory corruption and crashes.","summary":"Netpbm through 11.16.00 has a heap out-of-bounds write in the Sun rasterfile run-length decoder (pr_load_image in converter/other/rast.c) used by rasttopnm. A crafted rasterfile with tiny dimensions and a long run-length body writes attacker-controlled bytes past a heap buffer, causing memory corruption and crashes.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","netpbm","package"],"not_affected_if":["no-untrusted-input"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-19T14:17:05+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:40:51+00:00","updated_at":"2026-10-25T03:40:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:40:51Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Netpbm: crafted Sun rasterfile input corrupts heap memory in rasttopnm","impact":"medium","summary":"Netpbm through 11.16.00 has a heap out-of-bounds write in the Sun rasterfile run-length decoder (pr_load_image in converter/other/rast.c) used by rasttopnm. A crafted rasterfile with tiny dimensions and a long run-length body writes attacker-controlled bytes past a heap buffer, causing memory corruption and crashes.","category":"package","nicknames":[],"who_cares":["netpbm","image-processing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Heap memory corruption and process crashes; code execution not stated","analyst_note":"Check the NVD entry and the Netpbm project for the fixed version and whether code execution is feasible beyond the crash described.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-untrusted-input"],"who_is_affected":"Systems that run rasttopnm or other Netpbm converters on untrusted Sun rasterfile (.ras) input, such as image-processing pipelines that accept user uploads. Sites that only process trusted images or do not use Netpbm can skip it. unknown beyond that.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000584,"input_tokens":3360,"output_tokens":497,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112275':13A,16A '-2026':12A,15A '11.16.00':24B,78C 'attack':64B,102C 'attacker-control':63B 'bodi':61B,119C 'bound':31B,85C 'buffer':70B 'byte':66B,107C,123C 'byte-encod':106C 'caus':71B,127C 'contain':79C 'control':65B,122C 'converter/other/rast.c':45B,101C 'corrupt':6A,73B,129C 'craft':2A,50B 'crash':75B,131C 'cve':11A,14A 'decod':40B,96C 'dimens':54B,112C 'encod':108C 'heap':7A,27B,69B,81C 'imag':18B,43B,99C,126C 'image-process':17B 'input':5A 'length':39B,60B,95C,118C 'load':42B,98C 'long':57B,115C 'md':125C 'memori':8A,72B,128C 'netpbm':1A,20B,22B,76C 'out-of-bound':28B,82C 'packag':21B 'past':67B,124C 'pr':41B,97C 'process':19B 'rasterfil':4A,36B,51B,92C,109C 'rasttopnm':10A,48B,90C 'run':38B,59B,94C,117C 'run-length':37B,58B,93C,116C 'sun':3A,35B,91C 'suppli':104C 'tini':53B,111C 'use':46B 'vulner':87C 'write':32B,62B,86C,121C","nicknames":[],"mitigations":[],"who_affected":"Systems that run rasttopnm or other Netpbm converters on untrusted Sun rasterfile (.ras) input, such as image-processing pipelines that accept user uploads. Sites that only process trusted images or do not use Netpbm can skip it. unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112275","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112275","severity":null,"published_at":"2026-10-19T14:17:05+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}