Live › vulnerability › CVE-2026-120435
Netpbm's xpmtoppm tool trusts a characters-per-pixel value in an XPM image header, so a crafted file overruns a fixed heap buffer. An attacker who gets a victim to convert such a file can crash the tool or possibly run code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Netpbm builds that include the xpmtoppm converter are exposed when they convert XPM files from untrusted sources. Systems that never process XPM input from outside, or that do not install Netpbm, can skip it. unknown for any deployment-specific exposure beyond that.
No product ranges from the sources yet.
ppmtopgm --version or xpmtoppm --version (or check the installed Netpbm package version) and compare against the fixed ranges.xpmtoppm binary in use on systems that process untrusted XPM images.10.86.51 (before 10.86.51 is affected)11.02.30 for the 11.x line (before 11.02.30 is affected)11.15.08 for the 11.03 line (11.03 before 11.15.08 is affected)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte colorName hash entries, causing crashes or potentially code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-120435")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.