{"id":"CVE-2026-112276","kind":"vulnerability","aliases":["CVE-2026-112276"],"related":[],"title":"Netpbm: rasttopnm heap over-read leaks adjacent heap memory from crafted rasterfiles","description":"Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program.","summary":"Netpbm's rasttopnm tool reads past the end of a colormap when a Sun rasterfile has pixel values larger than the palette length. An attacker who supplies a crafted file can leak up to 255 adjacent heap bytes into the PNM output or crash the program.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-conversion","linux","netpbm","package"],"not_affected_if":["no-untrusted-rasterfiles"],"how_to_check":"- `rasttopnm --version` or check the installed Netpbm package version against the range through 11.16.00\n- unknown whether the sources list a specific package manager check","fix":"- Move Netpbm past `11.16.00` once a fixed release is published; the sources do not name a fixed version\n- Until patched, avoid running `rasttopnm` on untrusted Sun rasterfiles","status":"open","published_at":"2026-10-19T14:17:05+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:40:51+00:00","updated_at":"2026-10-25T03:40:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:40:51Z","model":"claude-haiku-5-5","output":{"fix":"- Move Netpbm past `11.16.00` once a fixed release is published; the sources do not name a fixed version\n- Until patched, avoid running `rasttopnm` on untrusted Sun rasterfiles","reach":"unknown","title":"Netpbm: rasttopnm heap over-read leaks adjacent heap memory from crafted rasterfiles","impact":"low","summary":"Netpbm's rasttopnm tool reads past the end of a colormap when a Sun rasterfile has pixel values larger than the palette length. An attacker who supplies a crafted file can leak up to 255 adjacent heap bytes into the PNM output or crash the program.","category":"package","nicknames":[],"who_cares":["netpbm","image-conversion","linux"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Heap memory leaks into output or the program crashes","analyst_note":"Find the upstream Netpbm advisory or fixed release version and confirm whether the flaw is reachable through a network-facing conversion path.","how_to_check":"- `rasttopnm --version` or check the installed Netpbm package version against the range through 11.16.00\n- unknown whether the sources list a specific package manager check","needs_analyst":true,"not_affected_if":["no-untrusted-rasterfiles"],"who_is_affected":"Systems that run Netpbm's rasttopnm on Sun rasterfiles that come from outside the team, such as image conversion services or upload pipelines. Installations that never convert Sun raster files or only handle trusted inputs are unlikely to be exposed. The sources do not describe a default configuration that makes it reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3358,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112276':16A,19A '-2026':15A,18A '11.16.00':74C '255':60B,116C 'adjac':8A,61B,117C 'allow':87C 'attack':50B,88C,100C 'bound':81C 'byte':63B,107C,119C 'colormap':36B,99C,103C 'contain':75C 'convers':22B 'craft':12A,54B,102C 'crash':69B,125C 'cve':14A,17A 'end':33B 'exceed':108C 'file':55B 'heap':3A,9A,62B,77C,91C,118C 'imag':21B 'image-convers':20B 'larger':44B 'leak':7A,57B,113C 'length':48B,111C 'linux':23B 'memori':10A,92C 'netpbm':1A,24B,26B,72C 'out-of-bound':78C 'output':67B,123C 'over-read':4A 'packag':25B 'palett':47B,110C 'past':31B 'pixel':42B,106C 'pnm':66B,122C 'program':71B,127C 'rasterfil':13A,40B,96C,104C 'rasttopnm':2A,28B,85C 'read':6A,30B,82C,90C 'short':98C 'sun':39B,95C 'suppli':52B,94C 'tool':29B 'valu':43B 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Systems that run Netpbm's rasttopnm on Sun rasterfiles that come from outside the team, such as image conversion services or upload pipelines. Installations that never convert Sun raster files or only handle trusted inputs are unlikely to be exposed. The sources do not describe a default configuration that makes it reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112276","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112276","severity":null,"published_at":"2026-10-19T14:17:05+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}