CVE-2026-112275
Netpbm through 11.16.00 Heap Out-of-Bounds Write via rasttopnm pr_load_image
Netpbm Netpbm
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr_load_image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past md_image, causing memory corruption and crashes.
Text from CVE List
Affected versions 1
- Netpbmaffected: all versions through 11.16.00CVE List
References 5
- hackmd.io/@haindpwn/netpbm-sunraster-rle-oob-write-palette-oob-readAdvisoryvia CVE List
- vulncheck.com/advisories/netpbm-through-11.16.00-heap-out-of-bounds-write-via-rasttopnm-pr-load-imageAdvisoryvia CVE List
- sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rast.cReferencevia CVE List
- sourceforge.net/p/netpbm/code/5400/tree/super_stable/converter/other/rast.cReferencevia CVE List
- netpbm.sourceforge.net/Referencevia CVE List