Out-of-Bounds Read Vulnerability in Netpbm tgatoppm Converter

CVE-2026-120437

What is CVE-2026-120437?

The Netpbm image processing library suffers from an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function. This vulnerability arises when the code handles unchecked pixel values as color map indexes, which can allow attackers to craft malicious Targa files. When these files are processed, pixel values that exceed declared color map bounds can lead to application crashes and potentially expose adjacent memory segments in the output images. This flaw underscores the importance of rigorous bounds checking in image processing functions.

References