{"id":"CVE-2026-120434","kind":"vulnerability","aliases":["CVE-2026-120434"],"related":[],"title":"Netpbm: crafted PICT file overflows stack in picttoppm converter","description":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly() function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack array to crash the converter or potentially execute code.","summary":"Netpbm's picttoppm converter has a stack buffer overflow in its polygon handling, triggered when a PICT image has polygon edges producing more than 5000 points. An attacker who supplies a crafted PICT file can crash the converter or potentially run code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","linux","netpbm","package"],"not_affected_if":["no-untrusted-pict-input","picttoppm-unused"],"how_to_check":"- Check the installed Netpbm version with `pnmcat --version` or your package manager, and compare it against the fixed ranges below.\n- Find whether `picttoppm` is installed and used on untrusted PICT files, for example `which picttoppm`.","fix":"- Netpbm `10.86.51` or later for the 10.x line\n- Netpbm `11.02.30` or later for the 11.02.x line\n- Netpbm `11.15.08` or later for the 11.03 line","status":"open","published_at":"2026-11-02T15:17:25+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","triaged_at":"2026-11-02T15:25:57+00:00","updated_at":"2026-11-02T15:25:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T15:25:57Z","model":"claude-haiku-5-5","output":{"fix":"- Netpbm `10.86.51` or later for the 10.x line\n- Netpbm `11.02.30` or later for the 11.02.x line\n- Netpbm `11.15.08` or later for the 11.03 line","reach":"local","title":"Netpbm: crafted PICT file overflows stack in picttoppm converter","impact":"high","summary":"Netpbm's picttoppm converter has a stack buffer overflow in its polygon handling, triggered when a PICT image has polygon edges producing more than 5000 points. An attacker who supplies a crafted PICT file can crash the converter or potentially run code.","audience":"developers","category":"package","nicknames":[],"who_cares":["netpbm","image-processing","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Converter crashes, and code execution is possible on the host","analyst_note":"Confirm whether the NVD entry or the VulnCheck advisory states that code execution is practically achievable and whether the reach is network or local only.","how_to_check":"- Check the installed Netpbm version with `pnmcat --version` or your package manager, and compare it against the fixed ranges below.\n- Find whether `picttoppm` is installed and used on untrusted PICT files, for example `which picttoppm`.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-pict-input","picttoppm-unused"],"who_is_affected":"Systems that run picttoppm on PICT files from untrusted sources, such as image upload or conversion pipelines, are exposed. Installations that never convert PICT files, or convert only trusted files, are lower risk and can schedule the update.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4200,"output_tokens":616,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120434':12A,15A '-2026':11A,14A '10.86.51':66C '11':67C '11.02.30':70C '11.03':72C '11.15.08':74C '5000':46B,102C 'array':108C 'attack':49B,89C 'base':79C 'buffer':29B,80C 'code':63B,116C 'contain':75C 'convert':9A,25B,59B,112C 'converter/ppm/picttoppm.c':88C 'coord':106C 'craft':2A,53B,93C 'crash':57B,110C 'cve':10A,13A 'edg':42B,98C 'execut':115C 'file':4A,55B,95C 'function':86C 'handl':34B 'imag':17B,39B 'image-process':16B 'linux':19B 'netpbm':1A,20B,22B,64C 'overflow':5A,30B,81C,104C 'packag':21B 'pict':3A,38B,54B,94C 'picttoppm':8A,24B,83C 'point':47B,103C 'polygon':33B,41B,97C 'potenti':61B,114C 'process':18B 'produc':43B,99C 'run':62B 'scanpoli':85C 'stack':6A,28B,78C,107C 'stack-bas':77C 'suppli':51B,91C 'trigger':35B 'whose':96C 'x':68C","nicknames":[],"mitigations":[],"who_affected":"Systems that run picttoppm on PICT files from untrusted sources, such as image upload or conversion pipelines, are exposed. Installations that never convert PICT files, or convert only trusted files, are lower risk and can schedule the update.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","imageprocessing","linux","netpbm","package"],"first_public_at":"2026-11-02T15:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120434","severity":null,"published_at":"2026-11-02T15:17:25+00:00","modified_at":"2026-11-02T15:17:25+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","fetched_at":"2026-11-02T15:24:02+00:00","note":null}],"documents":[{"id":52456,"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-overflow-via-scanpoly","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}