CVE-2026-112276
Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program.
| CWE | CWE-125 |
| Vendor | netpbm |
| Product | netpbm |
| Published | Oct 19, 2026 |
| Last Updated | Oct 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for netpbm netpbm
Be the first to know when new medium vulnerabilities affecting netpbm netpbm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Affected Versions
Netpbm / Netpbm
0 ≤ 11.16.00
References
hackmd.io: https://hackmd.io/@haindpwn/netpbm-sunraster-rle-oob-write-palette-oob-read sourceforge.net: https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rasttopnm.c sourceforge.net: https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rast.c netpbm.sourceforge.net: https://netpbm.sourceforge.net/ vulncheck.com: https://www.vulncheck.com/advisories/netpbm-through-11.16.00-heap-out-of-bounds-read-via-rasttopnm-colormap hackmd.io: https://hackmd.io/@haindpwn/cve-2026-112275-112276-netpbm-sunraster-rle-oob-write-palette-oob-read
Credits
HaiND from the Post and Telecommunication Institute of Technology