CVE-2026-120431

Name of the Vulnerable Software and Affected Versions Netpbm versions prior to 10.86.51 Netpbm versions 11.x prior to 11.02.29 Netpbm versions 11.03 prior to 11.15.07

Description A heap-based buffer overflow exists in the readChannels() function of sgitopnm when processing RLE-compressed SGI images. RLE (Run-Length Encoding) is a simple form of lossless data compression. An attacker can use crafted SGI files with oversized offset table lengths to write controlled data beyond the heap buffer, which may lead to application crashes or arbitrary code execution.

Recommendations Update Netpbm to version 10.86.51 or later. Update Netpbm to version 11.02.29 or later. Update Netpbm to version 11.15.07 or later.