CVE-2026-120433

Name of the Vulnerable Software and Affected Versions Netpbm versions prior to 10.86.51 Netpbm versions 11.x prior to 11.02.30 Netpbm versions 11.03 prior to 11.15.08

Description A stack-based buffer overflow exists in the paintPoly() function of the picttoppm utility. This occurs because the software does not limit the number of points in a polygon. An attacker can use a specially crafted PICT file containing a polygon with more than 100 points to overwrite the fixed pts array, which may lead to application crashes or arbitrary code execution.

Recommendations Update Netpbm to version 10.86.51 or later. Update Netpbm to version 11.02.30 or later. Update Netpbm to version 11.15.08 or later.