{"id":"CVE-2026-120436","kind":"vulnerability","aliases":["CVE-2026-120436"],"related":[],"title":"Netpbm: crafted JBIG file overflows heap buffer in jbigtopnm","description":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.","summary":"Netpbm's jbigtopnm tool miscalculates an output buffer size when converting a crafted multi-plane JBIG file, causing a heap buffer overflow. An attacker who gets a malicious JBIG file processed can crash the tool or potentially execute code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-conversion","linux","netpbm","package"],"not_affected_if":["netpbm-not-installed","no-untrusted-jbig-input"],"how_to_check":"- Check the installed Netpbm version with `pnmcat --version` or your package manager (for example `dpkg -l netpbm`); compare against the fixed ranges below.\n- Find out whether `jbigtopnm` is installed and whether anything feeds it untrusted JBIG files.","fix":"- Netpbm `10.86.51` or later in the 10.x line\n- Netpbm `11.02.30` or later in the 11.02 line\n- Netpbm `11.15.08` or later for the 11.03 line","status":"open","published_at":"2026-11-02T15:17:25+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","triaged_at":"2026-11-02T15:25:54+00:00","updated_at":"2026-11-02T15:25:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T15:25:54Z","model":"claude-haiku-5-5","output":{"fix":"- Netpbm `10.86.51` or later in the 10.x line\n- Netpbm `11.02.30` or later in the 11.02 line\n- Netpbm `11.15.08` or later for the 11.03 line","reach":"local","title":"Netpbm: crafted JBIG file overflows heap buffer in jbigtopnm","impact":"high","summary":"Netpbm's jbigtopnm tool miscalculates an output buffer size when converting a crafted multi-plane JBIG file, causing a heap buffer overflow. An attacker who gets a malicious JBIG file processed can crash the tool or potentially execute code.","audience":"developers","category":"package","nicknames":[],"who_cares":["netpbm","image-conversion","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker may run code via crafted JBIG file","analyst_note":"Confirm whether the attack vector is local file processing only or reachable over a network service, and check the vulncheck advisory for exploit details.","how_to_check":"- Check the installed Netpbm version with `pnmcat --version` or your package manager (for example `dpkg -l netpbm`); compare against the fixed ranges below.\n- Find out whether `jbigtopnm` is installed and whether anything feeds it untrusted JBIG files.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-jbig-input","netpbm-not-installed"],"who_is_affected":"Exposure requires that jbigtopnm processes JBIG files from an untrusted source, such as a file upload or conversion service. Systems that only convert files they create themselves, or that do not have Netpbm installed, are not meaningfully exposed. The sources do not say which default configurations ship the tool enabled.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4205,"output_tokens":657,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120436':12A,15A '-2026':11A,14A '10.86.51':64C '11':65C '11.02.30':68C '11.03':70C '11.15.08':72C 'attack':46B,89C 'buffer':7A,29B,43B,82C,87C,111C 'caus':40B,80C,112C 'code':61B,116C 'comput':85C 'contain':73C 'convers':18B 'convert':32B 'craft':2A,34B,93C 'crash':55B,113C 'cve':10A,13A 'dec':105C 'dimens':102C 'execut':60B,117C 'file':4A,39B,52B,98C 'get':48B 'header':101C 'heap':6A,42B,81C 'imag':17B 'image-convers':16B 'integ':75C 'jbg':104C 'jbig':3A,38B,51B,97C 'jbigtopnm':9A,24B,78C 'larg':100C 'linux':19B 'malici':50B 'merg':106C 'miscalcul':26B 'multi':36B,95C 'multi-plan':35B,94C 'netpbm':1A,20B,22B,62C 'output':28B,86C 'overflow':5A,44B,76C,83C,108C 'packag':21B 'plane':37B,96C,107C 'potenti':59B,115C 'process':53B 'size':30B,88C 'suppli':91C 'tool':25B,57B 'unders':110C 'x':66C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires that jbigtopnm processes JBIG files from an untrusted source, such as a file upload or conversion service. Systems that only convert files they create themselves, or that do not have Netpbm installed, are not meaningfully exposed. The sources do not say which default configurations ship the tool enabled.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","imageconversion","linux","netpbm","package"],"first_public_at":"2026-11-02T15:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120436","severity":null,"published_at":"2026-11-02T15:17:25+00:00","modified_at":"2026-11-02T15:17:25+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","fetched_at":"2026-11-02T15:24:02+00:00","note":null}],"documents":[{"id":52458,"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-heap-overflow-via-jbigtopnm","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}