CVE-2026-120436
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer…
- Risk score
- 47/100
- CVSS
- 7.8 v3.1
- Published
- 2 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buff…
- Affected
- See advisory
- Fix
- Upgrade the product to 10.86.51, 11.02.30, 11.03 or 11.15.08 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.8 high
References
- https://sourceforge.net/p/netpbm/code/5324/
- https://svn.code.sf.net/p/netpbm/code/!svn/bc/5323/trunk/converter/other/jbig/jbigtopnm.c
- https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY
- https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY
- https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY
- https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-heap-overflow-via-jbigtopnm
Original description
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.
Last activity 2 Nov 2026. Patch Forecast updates every hour.