CVE-2026-120434

EUVD-2026-115194
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly() function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack array to crash the converter or potentially execute code.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
netpbm_projectnetpbm
𝑥
< 10.86.51
CNA
netpbm_projectnetpbm
11.0 ≤
𝑥
< 11.2.30
CNA
netpbm_projectnetpbm
11.3 ≤
𝑥
< 11.15.8
CNA
Common Weakness Enumeration
References
https://sourceforge.net/p/netpbm/code/5331/
https://svn.code.sf.net/p/netpbm/code/!svn/bc/5330/trunk/converter/ppm/picttoppm.c
https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY
https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY
https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY
https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-overflow-via-scanpoly