CVE-2026-120436

LOWCVSS 8.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-190

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR15h
🚨High - Netpbm memory corruption in two converters via crafted image files (CVE-2026-120433, CVE-2026-120436) picttoppm's paintPoly() copies polygon points into a fixed pts array with no bound, so a PICT file declaring more than 100 points smashes the stack. jbigtopnm overflows the integer math that sizes its output buffer, so a multi-plane JBIG file with large header dimensions sends jbg_dec_merge_planes() writing past an undersized heap allocation. Crash at minimum, possible code execution — matters most where these converters run unattended on uploaded images. 👉Affected: Netpbm < 10.86.51, 11.x < 11.02.30, 11.03 < 11.15.08 | Upgrade to 11.15.08+
0001090
386 followersView on X

Explore more

Back to dashboard