---
id: "CVE-2026-120436"
kind: "vulnerability"
aliases: ["CVE-2026-120436"]
title: "Netpbm: crafted JBIG file overflows heap buffer in jbigtopnm"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["image-conversion", "linux", "netpbm", "package"]
not_affected_if: ["netpbm-not-installed", "no-untrusted-jbig-input"]
published_at: "2026-11-02T15:17:25+00:00"
first_seen_at: "2026-11-02T15:24:02+00:00"
updated_at: "2026-11-02T15:25:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120436", "first_seen_at": "2026-11-02T15:24:02+00:00"}]
---

# Netpbm: crafted JBIG file overflows heap buffer in jbigtopnm

Netpbm's jbigtopnm tool miscalculates an output buffer size when converting a crafted multi-plane JBIG file, causing a heap buffer overflow. An attacker who gets a malicious JBIG file processed can crash the tool or potentially execute code.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Netpbm version with `pnmcat --version` or your package manager (for example `dpkg -l netpbm`); compare against the fixed ranges below.
- Find out whether `jbigtopnm` is installed and whether anything feeds it untrusted JBIG files.

## Fix

- Netpbm `10.86.51` or later in the 10.x line
- Netpbm `11.02.30` or later in the 11.02 line
- Netpbm `11.15.08` or later for the 11.03 line

## Timeline

- 2026-11-02T15:24:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120436

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-heap-overflow-via-jbigtopnm

## From the sources

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_