{"id":"CVE-2026-120432","kind":"vulnerability","aliases":["CVE-2026-120432"],"related":[],"title":"Netpbm: crafted icon file corrupts heap memory in winicontopam","description":"Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16_t loop counters into negative row buffer indices to cause crashes or potential code execution.","summary":"Netpbm's winicontopam converter has an integer overflow when reading ICO or CUR files with width or height above 32767. A crafted icon file can corrupt heap memory, causing a crash or possibly code execution.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","netpbm","package","self-hosted"],"not_affected_if":["no-untrusted-icon-input"],"how_to_check":"- Check the installed Netpbm version (for example with `pnmcat --version` or your package manager) and compare it against the fixed versions listed under Fix.\n- Look for `winicontopam` on systems that convert untrusted ICO or CUR files.","fix":"- Netpbm `10.86.51`, `11.02.30`, or `11.15.08` (the fixed release on each branch)","status":"open","published_at":"2026-11-02T15:17:24+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","triaged_at":"2026-11-02T15:25:59+00:00","updated_at":"2026-11-02T15:25:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T15:25:59Z","model":"claude-haiku-5-5","output":{"fix":"- Netpbm `10.86.51`, `11.02.30`, or `11.15.08` (the fixed release on each branch)","reach":"unknown","title":"Netpbm: crafted icon file corrupts heap memory in winicontopam","impact":"high","summary":"Netpbm's winicontopam converter has an integer overflow when reading ICO or CUR files with width or height above 32767. A crafted icon file can corrupt heap memory, causing a crash or possibly code execution.","audience":"developers","category":"package","nicknames":[],"who_cares":["netpbm","image-processing","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Heap corruption could lead to a crash or code execution on the server","analyst_note":"Confirm the attack vector and whether a crafted file needs user interaction; check the vulncheck advisory linked from the signal.","how_to_check":"- Check the installed Netpbm version (for example with `pnmcat --version` or your package manager) and compare it against the fixed versions listed under Fix.\n- Look for `winicontopam` on systems that convert untrusted ICO or CUR files.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-icon-input"],"who_is_affected":"Systems that run Netpbm's winicontopam tool on icon files from outside sources, such as image conversion services or build pipelines that accept user uploads. Installations that never convert untrusted ICO or CUR files are much less exposed. unknown whether default configurations change exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":4192,"output_tokens":581,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120432':12A,15A '-2026':11A,14A '10.86.51':61C '11.02.30':62C '11.15.08':64C '32767':43B,95C 'allow':73C 'attack':74C,83C 'buffer':104C 'caus':52B,107C 'code':57B,111C 'contain':65C 'convert':27B 'corrupt':5A,49B,76C 'counter':100C 'craft':2A,45B,87C 'crash':54B,108C 'cur':36B 'cve':10A,13A 'dimens':82C 'execut':58B,112C 'file':4A,37B,47B,89C 'heap':6A,50B,77C 'height':41B,93C 'host':23B 'ico':34B 'ico/cur':81C 'icon':3A,46B,88C 'imag':17B 'image-process':16B 'indic':105C 'int16':97C 'integ':30B,67C 'loop':99C 'memori':7A,51B,78C 'negat':102C 'netpbm':1A,19B,24B,59C 'overflow':31B,68C 'overs':80C 'packag':20B 'possibl':56B 'potenti':110C 'process':18B 'read':33B 'row':103C 'self':22B 'self-host':21B 'suppli':85C 'via':79C 'vulner':69C 'width':39B,91C 'winicontopam':9A,26B,71C 'wrap':96C","nicknames":[],"mitigations":[],"who_affected":"Systems that run Netpbm's winicontopam tool on icon files from outside sources, such as image conversion services or build pipelines that accept user uploads. Installations that never convert untrusted ICO or CUR files are much less exposed. unknown whether default configurations change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","imageprocessing","netpbm","package","selfhosted"],"first_public_at":"2026-11-02T15:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120432","severity":null,"published_at":"2026-11-02T15:17:24+00:00","modified_at":"2026-11-02T15:17:24+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","fetched_at":"2026-11-02T15:24:01+00:00","note":null}],"documents":[{"id":52454,"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-integer-overflow-in-winicontopam","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}