CVE-2026-120432

Name of the Vulnerable Software and Affected Versions Netpbm versions prior to 10.86.51 Netpbm versions prior to 11.02.30 Netpbm versions prior to 11.15.08

Description Multiple issues exist in the software that can lead to crashes or remote code execution when processing crafted files. In the winicontopam tool, an integer overflow occurs when handling ICO or CUR files with width or height dimensions exceeding 32767. This causes int16 t loop counters to wrap into negative row buffer indices, resulting in heap memory corruption. Additionally, the picttoppm tool contains a stack overflow in the paintPoly() function when processing PICT polygons with more than 100 points. Finally, the jbigtopnm tool is subject to an integer overflow when processing large multi-plane JBIG files, which leads to a heap buffer overflow.

Recommendations Update to version 10.86.51 or later. Update to version 11.02.30 or later. Update to version 11.15.08 or later.