{"id":"CVE-2026-120431","title":"Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflow","summary":"Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with ov…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-122"],"vendor":"Netpbm","product":"Netpbm","affected":["Netpbm < 10.86.51","Netpbm >= 11.0 < 11.02.29","Netpbm >= 11.03 < 11.15.07"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-06T19:27:23.324500Z"},"published":"2026-11-02","updated":"2026-11-06","sourceUpdated":"2026-11-06T19:28:27.751Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120431","references":[{"url":"https://sourceforge.net/p/netpbm/code/5317/"},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5319/stable/doc/HISTORY"},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5318/advanced/doc/HISTORY"},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY"},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5316/trunk/converter/other/sgitopnm.c"},{"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.29-and-11.15.07-sgitopnm-heap-buffer-overflow","label":"VulnCheck Advisory: Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflow"}],"tags":["cve.org"],"epss":0.00149,"epssPercentile":0.04083,"ingestedAt":"2026-11-05T19:30:42.653Z","slug":"CVE-2026-120431","body":"## Overview\n\nNetpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution.\n\n## Affected\n\n- `Netpbm < 10.86.51`\n- `Netpbm >= 11.0 < 11.02.29`\n- `Netpbm >= 11.03 < 11.15.07`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}