CVE-2026-120433

LOWCVSS 8.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-121

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR15h
🚨High - Netpbm memory corruption in two converters via crafted image files (CVE-2026-120433, CVE-2026-120436) picttoppm's paintPoly() copies polygon points into a fixed pts array with no bound, so a PICT file declaring more than 100 points smashes the stack. jbigtopnm overflows the integer math that sizes its output buffer, so a multi-plane JBIG file with large header dimensions sends jbg_dec_merge_planes() writing past an undersized heap allocation. Crash at minimum, possible code execution — matters most where these converters run unattended on uploaded images. 👉Affected: Netpbm < 10.86.51, 11.x < 11.02.30, 11.03 < 11.15.08 | Upgrade to 11.15.08+
0001090
386 followersView on X

Explore more

Back to dashboard