CVE-2026-120434

Name of the Vulnerable Software and Affected Versions Netpbm versions prior to 10.86.51 Netpbm versions 11.x prior to 11.02.30 Netpbm versions 11.03 prior to 11.15.08

Description A stack-based buffer overflow exists in the scanPoly() function within the converter/ppm/picttoppm.c file of the picttoppm utility. This occurs when the converter processes a specially crafted PICT file containing polygon edges that generate more than 5000 points, causing the coord stack array to overflow. This can lead to a program crash or potential arbitrary code execution.

Recommendations Update Netpbm to version 10.86.51 or later. Update Netpbm to version 11.02.30 or later. Update Netpbm to version 11.15.08 or later.