CVE-2026-120437

Name of the Vulnerable Software and Affected Versions Netpbm versions prior to 10.86.51 Netpbm versions 11.x prior to 11.02.30 Netpbm versions 11.03 prior to 11.15.08

Description An out-of-bounds read exists in the get pixel() function of the tgatoppm converter. The issue occurs because the converter uses unchecked pixel values as color map indexes. A remote attacker can provide a specially crafted color-mapped Targa file with pixel values that exceed the declared color map bounds, leading to a program crash or the leakage of adjacent memory into the resulting output image.

Recommendations Update Netpbm to version 10.86.51 or later. Update Netpbm to version 11.02.30 or later. Update Netpbm to version 11.15.08 or later.