Heap Out-of-Bounds Read in Netpbm Affects Raster Conversion Feature
CVE-2026-112276
6.9MEDIUM
What is CVE-2026-112276?
Netpbm versions up to 11.16.00 have a flaw in the rasttopnm function that leads to a heap out-of-bounds read. This vulnerability arises when attackers provide specially crafted Sun rasterfiles with short colormaps, enabling them to exceed the palette length of pixel bytes. Consequently, the attackers could leak sensitive data by accessing up to 255 adjacent heap bytes in the PNM output or potentially crash the application.
Affected Version(s)
Netpbm 0 <= 11.16.00
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology