{"id":"CVE-2026-120435","kind":"vulnerability","aliases":["CVE-2026-120435"],"related":[],"title":"Netpbm: crafted XPM file overflows heap in xpmtoppm converter","description":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte colorName hash entries, causing crashes or potentially code execution.","summary":"Netpbm's xpmtoppm tool trusts a characters-per-pixel value in an XPM image header, so a crafted file overruns a fixed heap buffer. An attacker who gets a victim to convert such a file can crash the tool or possibly run code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","linux","netpbm","package","xpmtoppm"],"not_affected_if":["netpbm-not-installed","no-untrusted-xpm-input"],"how_to_check":"- Run `ppmtopgm --version` or `xpmtoppm --version` (or check the installed Netpbm package version) and compare against the fixed ranges.\n- Look for the `xpmtoppm` binary in use on systems that process untrusted XPM images.","fix":"- Netpbm `10.86.51` (before 10.86.51 is affected)\n- Netpbm `11.02.30` for the 11.x line (before 11.02.30 is affected)\n- Netpbm `11.15.08` for the 11.03 line (11.03 before 11.15.08 is affected)","status":"open","published_at":"2026-11-02T15:17:25+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","triaged_at":"2026-11-02T15:25:57+00:00","updated_at":"2026-11-02T15:25:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T15:25:57Z","model":"claude-haiku-5-5","output":{"fix":"- Netpbm `10.86.51` (before 10.86.51 is affected)\n- Netpbm `11.02.30` for the 11.x line (before 11.02.30 is affected)\n- Netpbm `11.15.08` for the 11.03 line (11.03 before 11.15.08 is affected)","reach":"local","title":"Netpbm: crafted XPM file overflows heap in xpmtoppm converter","impact":"high","summary":"Netpbm's xpmtoppm tool trusts a characters-per-pixel value in an XPM image header, so a crafted file overruns a fixed heap buffer. An attacker who gets a victim to convert such a file can crash the tool or possibly run code.","audience":"developers","category":"package","nicknames":[],"who_cares":["netpbm","xpmtoppm","image-processing","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Crash of the converter, possibly code execution in its process","analyst_note":"Confirm whether a public exploit or PoC exists and whether the local-only reach is accurate; the vulncheck advisory linked from NVD may say more.","how_to_check":"- Run `ppmtopgm --version` or `xpmtoppm --version` (or check the installed Netpbm package version) and compare against the fixed ranges.\n- Look for the `xpmtoppm` binary in use on systems that process untrusted XPM images.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-xpm-input","netpbm-not-installed"],"who_is_affected":"Netpbm builds that include the xpmtoppm converter are exposed when they convert XPM files from untrusted sources. Systems that never process XPM input from outside, or that do not install Netpbm, can skip it. unknown for any deployment-specific exposure beyond that.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4213,"output_tokens":674,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120435':12A,15A '-2026':11A,14A '10.86.51':69C '11':70C '11.02.30':73C '11.03':75C '11.15.08':77C '3':112C,116C 'attack':49B,98C 'buffer':47B,81C 'byte':117C 'caus':85C,121C 'charact':30B,90C,107C 'characters-per-pixel':29B,89C,106C 'code':66B,125C 'colornam':118C 'contain':78C 'convert':9A,55B 'craft':2A,41B,102C 'crash':60B,122C 'cve':10A,13A 'entri':120C 'execut':126C 'file':4A,42B,58B,104C 'fix':45B,115C 'get':51B 'greater':110C 'hash':119C 'header':38B,97C 'heap':6A,46B,80C 'imag':17B,37B 'image-process':16B 'linux':19B 'netpbm':1A,20B,23B,67C 'overflow':5A,82C 'overrun':43B,114C 'packag':21B 'per':31B,91C,108C 'pixel':32B,92C,109C 'possibl':64B 'potenti':124C 'process':18B 'run':65B 'suppli':100C 'tool':26B,62B 'trust':27B 'unvalid':88C 'valu':33B,93C 'victim':53B 'x':71C 'xpm':3A,36B,96C,103C 'xpmtoppm':8A,22B,25B,84C","nicknames":[],"mitigations":[],"who_affected":"Netpbm builds that include the xpmtoppm converter are exposed when they convert XPM files from untrusted sources. Systems that never process XPM input from outside, or that do not install Netpbm, can skip it. unknown for any deployment-specific exposure beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","imageprocessing","linux","netpbm","package","xpmtoppm"],"first_public_at":"2026-11-02T15:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120435","severity":null,"published_at":"2026-11-02T15:17:25+00:00","modified_at":"2026-11-02T15:17:25+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","fetched_at":"2026-11-02T15:24:02+00:00","note":null}],"documents":[{"id":52457,"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-heap-overflow-in-xpmtoppm","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}