Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.9

Netpbm sgitopnm may crash or be exploited

CVE-2026-120431 · published 2 days ago
Summary

The Netpbm image conversion tool sgitopnm can be tricked by a specially crafted SGI picture file to write data beyond its allocated memory. This can cause the program to stop working or, in rare cases, allow an attacker to run their own code. Upgrade Netpbm to a version newer than 10.86.51, 11.02.29, or 11.15.07, or apply any available patches.

What to do
  • Update netpbm netpbm to version 10.86.51 or later.
Affected software
Ecosystem VendorProductAffected versions
– netpbm netpbm < 10.86.51
Ubuntu:16.04:LTS canonical netpbm-free All versions
Original advisory text
Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflow
Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.9 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen2 Nov 2026
Sources
CVE-2026-120431 · NVD
CVE-2026-120431 · MITRE
UBUNTU-CVE-2026-120431 · OSV
Track software like this
Free during beta