---
id: "CVE-2026-112276"
kind: "vulnerability"
aliases: ["CVE-2026-112276"]
title: "Netpbm: rasttopnm heap over-read leaks adjacent heap memory from crafted rasterfiles"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["image-conversion", "linux", "netpbm", "package"]
not_affected_if: ["no-untrusted-rasterfiles"]
published_at: "2026-10-19T14:17:05+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:40:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112276", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Netpbm: rasttopnm heap over-read leaks adjacent heap memory from crafted rasterfiles

Netpbm's rasttopnm tool reads past the end of a colormap when a Sun rasterfile has pixel values larger than the palette length. An attacker who supplies a crafted file can leak up to 255 adjacent heap bytes into the PNM output or crash the program.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `rasttopnm --version` or check the installed Netpbm package version against the range through 11.16.00
- unknown whether the sources list a specific package manager check

## Fix

- Move Netpbm past `11.16.00` once a fixed release is published; the sources do not name a fixed version
- Until patched, avoid running `rasttopnm` on untrusted Sun rasterfiles

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112276

## From the sources

Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_