High severity7.8NVD Advisory· Published Nov 2, 2026
CVE-2026-120431
CVE-2026-120431
Description
Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution.
Affected products
1Patches
Vulnerability mechanics
References
6- sourceforge.net/p/netpbm/code/5317/nvd
- svn.code.sf.net/p/netpbm/code/!svn/bc/5316/trunk/converter/other/sgitopnm.cnvd
- svn.code.sf.net/p/netpbm/code/!svn/bc/5318/advanced/doc/HISTORYnvd
- svn.code.sf.net/p/netpbm/code/!svn/bc/5319/stable/doc/HISTORYnvd
- svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORYnvd
- www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.29-and-11.15.07-sgitopnm-heap-buffer-overflownvd
News mentions
0No linked articles in our index yet.