CVE-2026-120435

Name of the Vulnerable Software and Affected Versions Netpbm versions prior to 10.86.51 Netpbm versions 11.x prior to 11.02.30 Netpbm versions 11.03 prior to 11.15.08

Description A heap buffer overflow exists in the xpmtoppm() function due to an unvalidated characters-per-pixel value in the XPM header. An attacker can provide a specially crafted XPM file where the characters-per-pixel value exceeds 3, leading to an overrun of fixed 3-byte colorName hash entries. This can result in application crashes or potential arbitrary code execution.

Recommendations Update Netpbm to version 10.86.51 or later. Update Netpbm to version 11.02.30 or later. Update Netpbm to version 11.15.08 or later.