Live › vulnerability › CVE-2026-120432
Netpbm's winicontopam converter has an integer overflow when reading ICO or CUR files with width or height above 32767. A crafted icon file can corrupt heap memory, causing a crash or possibly code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Systems that run Netpbm's winicontopam tool on icon files from outside sources, such as image conversion services or build pipelines that accept user uploads. Installations that never convert untrusted ICO or CUR files are much less exposed. unknown whether default configurations change exposure.
No product ranges from the sources yet.
pnmcat --version or your package manager) and compare it against the fixed versions listed under Fix.winicontopam on systems that convert untrusted ICO or CUR files.10.86.51, 11.02.30, or 11.15.08 (the fixed release on each branch)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16_t loop counters into negative row buffer indices to cause crashes or potential code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-120432")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.