CVE-2026-120436

Name of the Vulnerable Software and Affected Versions Netpbm versions prior to 10.86.51 Netpbm versions 11.x prior to 11.02.30 Netpbm versions 11.03 prior to 11.15.08

Description An integer overflow exists in the jbigtopnm utility when calculating the output buffer size. A remote attacker can exploit this by providing a specially crafted multi-plane JBIG file with excessively large header dimensions. This leads to a heap buffer overflow within the jbg dec merge planes() function, which may result in application crashes or arbitrary code execution.

Recommendations Update Netpbm to version 10.86.51 or later. Update Netpbm versions 11.x to 11.02.30 or later. Update Netpbm versions 11.03 to 11.15.08 or later.