Heap Out-of-Bounds Write in Netpbm Sun Rasterfile Decoder

Executive Summary

CVE-2026-112275 is a heap out-of-bounds write vulnerability in Netpbm's rasttopnm tool. It occurs in the Sun rasterfile run-length decoder (pr_load_image) when processing crafted rasterfiles with tiny dimensions but long run-length data. This causes the function to write attacker-controlled bytes past the allocated memory buffer, leading to memory corruption and crashes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Netpbm installations for versions 11.16.1 or earlier. Check for suspicious rasterfiles processed by rasttopnm that may cause crashes or memory corruption. Monitor system logs for heap corruption errors during image conversion tasks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to corrupt memory or crash the rasttopnm tool by providing specially crafted rasterfiles. Successful exploitation could lead to denial-of-service conditions or potentially allow arbitrary code execution, depending on the system's memory layout and protections.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Netpbm to the latest version beyond 11.16.00. If updating is not possible, restrict access to rasttopnm or disable Sun rasterfile processing. Apply input validation to reject malformed rasterfiles with tiny dimensions and long run-length bodies.

Useful 0 Not Useful 0