Stack-Based Buffer Overflow in Netpbm picttoppm

Executive Summary

CVE-2026-120433 is a stack-based buffer overflow in Netpbm's picttoppm paintPoly() function. It occurs when processing PICT files with polygons containing more than 100 points. The fixed-size pts array on the stack can be overwritten, leading to crashes or potential code execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems running vulnerable Netpbm versions (before 10.86.51, 11.02.30, or 11.15.08) by checking the installed version of picttoppm. Use commands like 'picttoppm -version' or 'dpkg -l | grep netpbm' on Debian-based systems. Monitor for crashes when processing PICT files with polygons exceeding 100 points.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to crash applications using Netpbm or execute arbitrary code on your system. It requires a specially crafted PICT file, so simply opening a malicious file could trigger the issue.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to arbitrary code execution or denial-of-service conditions when processing malicious PICT files, potentially compromising data integrity and availability. For GDPR, this may violate Article 32 (security of processing) if exploited to access or manipulate personal data. For HIPAA, it could impact integrity and availability of protected health information if exploited in systems handling medical data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Netpbm to patched versions (10.86.51 or later, 11.02.30 or later, or 11.15.08 or later). Disable or restrict access to picttoppm if updates are not immediately feasible. Avoid processing untrusted PICT files until the update is applied.

Useful 0 Not Useful 0