CVE-2026-120437mediumCWE-125

CVE-2026-120437: falha de média gravidade em Netpbm

Netpbm before 10.86.51, 11.02.30, and 11.15.08 Out-of-Bounds Read via tgatoppm

Publicada em

Seguir esta CVE+ Monitorar Netpbm+ Monitorar netpbm-free

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.2%
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values exceed the declared color map bounds to crash the converter or leak adjacent memory into the output image.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Netpbm · Netpbm
CVEs relacionadas — Netpbm

No mesmo produto, das mais perigosas para as menos.

CVE-2026-112276MEDIUMNetpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm ColormapEPSS 0.2%CVE-2026-120436HIGHNetpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnmEPSS 0.2%CVE-2026-120433HIGHNetpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPolyEPSS 0.2%CVE-2026-120432HIGHNetpbm before 10.86.51, 11.02.30, and 11.15.08 Integer Overflow in winicontopamEPSS 0.2%CVE-2026-120435HIGHNetpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppmEPSS 0.1%CVE-2026-120434HIGHNetpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Overflow via scanPolyEPSS 0.1%