{"id":"CVE-2026-120433","kind":"vulnerability","aliases":["CVE-2026-120433"],"related":[],"title":"Netpbm: crafted PICT file overflows stack in picttoppm, enabling code execution","description":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.","summary":"Netpbm's picttoppm tool does not bound the number of polygon points in a PICT file, so a polygon with more than 100 points overwrites a fixed stack array. An attacker who supplies a crafted PICT file can crash the tool or potentially run code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-conversion","linux","netpbm","package"],"not_affected_if":["no-untrusted-pict-input","picttoppm-not-installed"],"how_to_check":"- Check the installed Netpbm version (for example with `pnmcat --version` or your package manager's query) and compare it with the fixed ranges below.\n- Look for the `picttoppm` binary and whether your pipelines or services convert PICT files with it.","fix":"- Netpbm `10.86.51` or later in the 10.x line\n- Netpbm `11.02.30` or later in the 11.02 line\n- Netpbm `11.15.08` or later in the 11.x line from 11.03","status":"open","published_at":"2026-11-02T15:17:24+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","triaged_at":"2026-11-02T15:25:58+00:00","updated_at":"2026-11-02T15:25:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T15:25:58Z","model":"claude-haiku-5-5","output":{"fix":"- Netpbm `10.86.51` or later in the 10.x line\n- Netpbm `11.02.30` or later in the 11.02 line\n- Netpbm `11.15.08` or later in the 11.x line from 11.03","reach":"unknown","title":"Netpbm: crafted PICT file overflows stack in picttoppm, enabling code execution","impact":"high","summary":"Netpbm's picttoppm tool does not bound the number of polygon points in a PICT file, so a polygon with more than 100 points overwrites a fixed stack array. An attacker who supplies a crafted PICT file can crash the tool or potentially run code.","audience":"businesses","category":"package","nicknames":[],"who_cares":["netpbm","image-conversion","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code on a machine converting a crafted PICT file","analyst_note":"Confirm whether exploitation is reachable remotely through typical PICT handling and whether the vulnerability is confirmed beyond the NVD description; check the VulnCheck advisory.","how_to_check":"- Check the installed Netpbm version (for example with `pnmcat --version` or your package manager's query) and compare it with the fixed ranges below.\n- Look for the `picttoppm` binary and whether your pipelines or services convert PICT files with it.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-pict-input","picttoppm-not-installed"],"who_is_affected":"Systems that run picttoppm on PICT files from untrusted sources, such as image conversion services or upload pipelines, are exposed. Installations that never convert PICT files, or that only process trusted input, can skip it.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4195,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120433':14A,17A '-2026':13A,16A '10.86.51':71C '100':46B,110C '11':72C '11.02.30':75C '11.03':77C '11.15.08':79C 'array':52B,117C 'attack':54B,99C 'base':84C 'bound':30B 'buffer':85C 'caus':118C 'code':10A,68B,122C 'contain':80C 'convers':20B 'count':98C 'craft':2A,58B,103C 'crash':62B,119C 'cve':12A,15A 'due':92C 'enabl':9A 'exceed':109C 'execut':11A,123C 'file':4A,39B,60B,105C 'fix':50B,115C 'function':91C 'imag':19B 'image-convers':18B 'linux':21B 'netpbm':1A,22B,24B,69C 'number':32B 'overflow':5A,86C 'overwrit':48B,113C 'packag':23B 'paintpoli':90C 'pict':3A,38B,59B,104C 'picttoppm':8A,26B,89C 'point':35B,47B,97C,111C 'polygon':34B,42B,96C,108C 'potenti':66B,121C 'pts':116C 'run':67B 'stack':6A,51B,83C 'stack-bas':82C 'suppli':56B,101C 'tool':27B,64B 'unbound':95C 'x':73C","nicknames":[],"mitigations":[],"who_affected":"Systems that run picttoppm on PICT files from untrusted sources, such as image conversion services or upload pipelines, are exposed. Installations that never convert PICT files, or that only process trusted input, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","imageconversion","linux","netpbm","package"],"first_public_at":"2026-11-02T15:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120433","severity":null,"published_at":"2026-11-02T15:17:24+00:00","modified_at":"2026-11-02T15:17:24+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","fetched_at":"2026-11-02T15:24:01+00:00","note":null}],"documents":[{"id":52455,"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-buffer-overflow-via-paintpoly","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}