Live › vulnerability › CVE-2026-120433
Netpbm's picttoppm tool does not bound the number of polygon points in a PICT file, so a polygon with more than 100 points overwrites a fixed stack array. An attacker who supplies a crafted PICT file can crash the tool or potentially run code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Systems that run picttoppm on PICT files from untrusted sources, such as image conversion services or upload pipelines, are exposed. Installations that never convert PICT files, or that only process trusted input, can skip it.
No product ranges from the sources yet.
pnmcat --version or your package manager's query) and compare it with the fixed ranges below.picttoppm binary and whether your pipelines or services convert PICT files with it.10.86.51 or later in the 10.x line11.02.30 or later in the 11.02 line11.15.08 or later in the 11.x line from 11.03Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-120433")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.