Live › vulnerability › CVE-2026-120437
Netpbm's tgatoppm converter trusts pixel values as color map indexes without bounds checks, so a crafted color-mapped Targa file can read past the color map. An attacker gets a crash of the converter or adjacent memory leaked into the output image.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Systems that run the tgatoppm converter on Targa files from untrusted sources, such as image-processing pipelines or upload handlers that shell out to Netpbm. Installations that only use Netpbm interactively on files the team creates can treat it as lower priority. The sources do not describe other exposure paths.
No product ranges from the sources yet.
pnmtopng --version or tgatoppm -version (if available) and compare to the fixed ranges.10.86.51 or later for the 10.x line11.02.30 or later for the 11.02 line11.15.08 or later for the 11.03 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values exceed the declared color map bounds to crash the converter or leak adjacent memory into the output image.
This page as .md · .json · in your agent: get_signal("CVE-2026-120437")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.