Integer Overflow Vulnerability in Netpbm Affects Multiple Versions
CVE-2026-120432

8.5HIGH

Key Information:

Vendor

Netpbm

Status
Netpbm
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120432?

Netpbm versions prior to 10.86.51, 11.02.30, and 11.15.08 are susceptible to an integer overflow vulnerability in the winicontopam component. This flaw occurs when oversized ICO or CUR files are processed, allowing attackers to manipulate the dimensions and overflow int16_t loop counters. As a result, this can lead to negative row buffer indices, causing crashes or potentially enabling the execution of arbitrary code.

Affected Version(s)

Netpbm 10.63 < 10.86.51

Netpbm 11.0 < 11.02.30

Netpbm 11.03 < 11.15.08

References

https://sourceforge.net/p/netpbm/code/5335/
patch
https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable...
release-notes
https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanc...
release-notes

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tristan Madani (Talence Security)
Bryan Henderson
.