{"id":"CVE-2026-120437","kind":"vulnerability","aliases":["CVE-2026-120437"],"related":[],"title":"Netpbm: crafted Targa file reads out of bounds in converter","description":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values exceed the declared color map bounds to crash the converter or leak adjacent memory into the output image.","summary":"Netpbm's tgatoppm converter trusts pixel values as color map indexes without bounds checks, so a crafted color-mapped Targa file can read past the color map. An attacker gets a crash of the converter or adjacent memory leaked into the output image.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","linux","netpbm","package"],"not_affected_if":["netpbm-not-installed","no-untrusted-tga-input"],"how_to_check":"- Run `pnmtopng --version` or `tgatoppm -version` (if available) and compare to the fixed ranges.\n- Check whether the system package manager lists a Netpbm package and its version.","fix":"- Netpbm `10.86.51` or later for the 10.x line\n- Netpbm `11.02.30` or later for the 11.02 line\n- Netpbm `11.15.08` or later for the 11.03 line","status":"open","published_at":"2026-11-02T15:17:25+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","triaged_at":"2026-11-02T15:26:12+00:00","updated_at":"2026-11-02T15:26:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T15:26:12Z","model":"claude-haiku-5-5","output":{"fix":"- Netpbm `10.86.51` or later for the 10.x line\n- Netpbm `11.02.30` or later for the 11.02 line\n- Netpbm `11.15.08` or later for the 11.03 line","reach":"local","title":"Netpbm: crafted Targa file reads out of bounds in converter","impact":"medium","summary":"Netpbm's tgatoppm converter trusts pixel values as color map indexes without bounds checks, so a crafted color-mapped Targa file can read past the color map. An attacker gets a crash of the converter or adjacent memory leaked into the output image.","audience":"developers","category":"package","nicknames":[],"who_cares":["netpbm","image-processing","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Converter crashes or leaks adjacent memory into output images","analyst_note":"","how_to_check":"- Run `pnmtopng --version` or `tgatoppm -version` (if available) and compare to the fixed ranges.\n- Check whether the system package manager lists a Netpbm package and its version.\n- unknown whether other checks apply; the sources do not say.","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-tga-input","netpbm-not-installed"],"who_is_affected":"Systems that run the tgatoppm converter on Targa files from untrusted sources, such as image-processing pipelines or upload handlers that shell out to Netpbm. Installations that only use Netpbm interactively on files the team creates can treat it as lower priority. The sources do not describe other exposure paths.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00072,"input_tokens":4213,"output_tokens":597,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120437':13A,16A '-2026':12A,15A '10.86.51':69C '11':70C '11.02.30':73C '11.03':75C '11.15.08':77C 'adjac':60B,128C 'attack':52B,103C 'bound':8A,35B,83C,121C 'check':36B 'color':31B,41B,49B,100C,109C,119C 'color-map':40B,108C 'contain':78C 'convert':10A,26B,58B,89C,125C 'craft':2A,39B,107C 'crash':55B,123C 'cve':11A,14A 'declar':118C 'exceed':116C 'file':4A,44B,112C 'function':93C 'get':53B,91C 'imag':18B,66B,133C 'image-process':17B 'index':33B,102C 'leak':62B,127C 'linux':20B 'map':32B,42B,50B,101C,110C,120C 'memori':61B,129C 'netpbm':1A,21B,23B,67C 'out-of-bound':80C 'output':65B,132C 'packag':22B 'past':47B 'pixel':28B,92C,97C,114C 'process':19B 'read':5A,46B,84C 'suppli':105C 'targa':3A,43B,111C 'tgatoppm':25B,88C 'trust':27B 'uncheck':96C 'use':95C 'valu':29B,98C,115C 'vulner':85C 'whose':113C 'without':34B 'x':71C","nicknames":[],"mitigations":[],"who_affected":"Systems that run the tgatoppm converter on Targa files from untrusted sources, such as image-processing pipelines or upload handlers that shell out to Netpbm. Installations that only use Netpbm interactively on files the team creates can treat it as lower priority. The sources do not describe other exposure paths.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["imageprocessing","linux","medium","netpbm","package"],"first_public_at":"2026-11-02T15:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120437","severity":null,"published_at":"2026-11-02T15:17:25+00:00","modified_at":"2026-11-02T15:17:25+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","fetched_at":"2026-11-02T15:24:02+00:00","note":null}],"documents":[{"id":52459,"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-out-of-bounds-read-via-tgatoppm","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}