Stack-based Buffer Overflow in Netpbm's PICT to PPM Converter
CVE-2026-120434

8.5HIGH

Key Information:

Vendor

Netpbm

Status
Netpbm
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120434?

A vulnerability exists in Netpbm's picttoppm function, specifically in the scanPoly() method, which can be exploited via crafted PICT files. When such files contain polygon edges with more than 5000 points, it triggers a stack-based buffer overflow, leading to unpredictable behavior including crashing the converter or execution of arbitrary code. Users and administrators of affected versions should implement recommended patches to mitigate risks associated with this flaw.

Affected Version(s)

Netpbm 0 < 10.86.51

Netpbm 11.0 < 11.02.30

Netpbm 11.03 < 11.15.08

References

https://sourceforge.net/p/netpbm/code/5331/
patch
https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable...
release-notes
https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanc...
release-notes

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tristan Madani (Talence Security)
Bryan Henderson
.