Skip to content
Threat Feed
Subscribe
high advisory

Netpbm: Heap-based buffer overflow in sgitopnm (CVE-2026-120431)

Netpbm is vulnerable to a heap-based buffer overflow in the sgitopnm utility via crafted SGI image files, potentially allowing for arbitrary code execution.

CVE search metadata

CVE search record: CVE-2026-120431. Severity: high. CVSS: 7.8. KEV: no. Product: Netpbm (< 10.86.51, 11.x < 11.02.29, 11.03 < 11.15.07), Netpbm (< 10.86.51, < 11.02.30, < 11.15.08), Netpbm (< 10.86.51, 11.02.30, 11.15.08), Netpbm (< 10.86.51, 11.x < 11.02.30, 11.03 < 11.15.08). Brief: Netpbm: Heap-based buffer overflow in sgitopnm (CVE-2026-120431). Brief link: https://feed.craftedsignal.io/briefs/2026-11-netpbm-heap-overflow/

CVE search record: CVE-2026-120432. Severity: high. CVSS: 7.8. KEV: no. Product: Netpbm (< 10.86.51, 11.x < 11.02.29, 11.03 < 11.15.07), Netpbm (< 10.86.51, < 11.02.30, < 11.15.08), Netpbm (< 10.86.51, 11.02.30, 11.15.08), Netpbm (< 10.86.51, 11.x < 11.02.30, 11.03 < 11.15.08). Brief: Netpbm: Heap-based buffer overflow in sgitopnm (CVE-2026-120431). Brief link: https://feed.craftedsignal.io/briefs/2026-11-netpbm-heap-overflow/

CVE search record: CVE-2026-120433. Severity: high. CVSS: 7.8. KEV: no. Product: Netpbm (< 10.86.51, 11.x < 11.02.29, 11.03 < 11.15.07), Netpbm (< 10.86.51, < 11.02.30, < 11.15.08), Netpbm (< 10.86.51, 11.02.30, 11.15.08), Netpbm (< 10.86.51, 11.x < 11.02.30, 11.03 < 11.15.08). Brief: Netpbm: Heap-based buffer overflow in sgitopnm (CVE-2026-120431). Brief link: https://feed.craftedsignal.io/briefs/2026-11-netpbm-heap-overflow/

CVE search record: CVE-2026-120434. Severity: high. CVSS: 7.8. KEV: no. Product: Netpbm (< 10.86.51, 11.x < 11.02.29, 11.03 < 11.15.07), Netpbm (< 10.86.51, < 11.02.30, < 11.15.08), Netpbm (< 10.86.51, 11.02.30, 11.15.08), Netpbm (< 10.86.51, 11.x < 11.02.30, 11.03 < 11.15.08). Brief: Netpbm: Heap-based buffer overflow in sgitopnm (CVE-2026-120431). Brief link: https://feed.craftedsignal.io/briefs/2026-11-netpbm-heap-overflow/

CVE search record: CVE-2026-120435. Severity: high. CVSS: 7.8. KEV: no. Product: Netpbm (< 10.86.51, 11.x < 11.02.29, 11.03 < 11.15.07), Netpbm (< 10.86.51, < 11.02.30, < 11.15.08), Netpbm (< 10.86.51, 11.02.30, 11.15.08), Netpbm (< 10.86.51, 11.x < 11.02.30, 11.03 < 11.15.08). Brief: Netpbm: Heap-based buffer overflow in sgitopnm (CVE-2026-120431). Brief link: https://feed.craftedsignal.io/briefs/2026-11-netpbm-heap-overflow/

Triage facts

Revision 2
Applicability
Netpbm (< 10.86.51, 11.x < 11.02.29, 11.03 < 11.15.07), Netpbm (< 10.86.51, < 11.02.30, < 11.15.08) +2
Evidence
Unknown
Severity
High
Action
Elevated
Sources
5 public sources
Freshness
Revision 2Nov 2, 15:52 UTC
Vulnerabilities
5 CVEs
Source quality
A2Roughly even chance
Revision history 1 entry · Revision 2
  1. Revision 2

    added CVE-2026-120435

    Changed: claim_state, cves, lastmod, references, updates

    Sources: 1

Netpbm versions before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 are affected by a heap-based buffer overflow vulnerability in the sgitopnm utility. The flaw exists within the readChannels() function and is triggered when processing RLE-compressed SGI images containing an oversized offset table. Successful exploitation can result in application crashes or arbitrary code execution.

Impact

Successful exploitation may lead to a crash of the sgitopnm utility (Denial of Service) or arbitrary code execution in the context of the user executing the tool.

Recommendation

  • Inventory all systems utilizing Netpbm or libraries relying on sgitopnm.
  • Update Netpbm to version 10.86.51, 11.02.29, 11.15.07, or later to address the vulnerability.
  • Implement file integrity monitoring for high-risk input processing pipelines that utilize legacy image processing libraries.

Immediate actions

Upgrade Netpbm to 10.86.51, 11.02.29, 11.15.07 or later

IT Operations 7d

Threat Hunt

Identify processes executing sgitopnm with RLE-compressed SGI image inputs

T1203 medium medium confidence hunt now

Data: Process command line arguments for sgitopnm, File access logs indicating processed .sgi or .rgb files

Identify systems utilizing winicontopam on untrusted input

T1203 medium medium confidence hunt now

Data: Process execution logs, Application logs showing image processing events

Search for the usage of the 'picttoppm' binary in system process logs to identify servers or applications utilizing this component.

T1203 medium high confidence hunt now

Data: Process creation logs (e.g., Sysmon Event ID 1, Linux auditd)

Mitigations

Upgrade Netpbm to 10.86.51 or later

immediate IT Operations

CVE-2026-120431

Upgrade Netpbm to 10.86.51, 11.02.30, 11.15.08 or later

immediate IT Operations

CVE-2026-120432

Upgrade Netpbm to version 10.86.51, 11.02.30, or 11.15.08 or later to patch CVE-2026-120433

immediate IT Operations

CVE-2026-120433

Upgrade Netpbm to 10.86.51, 11.02.30, or 11.15.08.

immediate IT Operations

CVE-2026-120434