Live › vulnerability › CVE-2026-112276
Go to dashboardNetpbm's rasttopnm tool reads past the end of a colormap when a Sun rasterfile has pixel values larger than the palette length. An attacker who supplies a crafted file can leak up to 255 adjacent heap bytes into the PNM output or crash the program.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that run Netpbm's rasttopnm on Sun rasterfiles that come from outside the team, such as image conversion services or upload pipelines. Installations that never convert Sun raster files or only handle trusted inputs are unlikely to be exposed. The sources do not describe a default configuration that makes it reachable.
No product ranges from the sources yet.
rasttopnm --version or check the installed Netpbm package version against the range through 11.16.0011.16.00 once a fixed release is published; the sources do not name a fixed versionrasttopnm on untrusted Sun rasterfilesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program.
This page as .md · .json · in your agent: get_signal("CVE-2026-112276")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.