Live › vulnerability › CVE-2026-120434
Netpbm's picttoppm converter has a stack buffer overflow in its polygon handling, triggered when a PICT image has polygon edges producing more than 5000 points. An attacker who supplies a crafted PICT file can crash the converter or potentially run code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Systems that run picttoppm on PICT files from untrusted sources, such as image upload or conversion pipelines, are exposed. Installations that never convert PICT files, or convert only trusted files, are lower risk and can schedule the update.
No product ranges from the sources yet.
pnmcat --version or your package manager, and compare it against the fixed ranges below.picttoppm is installed and used on untrusted PICT files, for example which picttoppm.10.86.51 or later for the 10.x line11.02.30 or later for the 11.02.x line11.15.08 or later for the 11.03 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly() function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack array to crash the converter or potentially execute code.
This page as .md · .json · in your agent: get_signal("CVE-2026-120434")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.