CVE-2026-120435 in Netpbm
Summary
by MITRE • 11/02/2026
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte colorName hash entries, causing crashes or potentially code execution.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The Netpbm image processing library contains a critical heap buffer overflow vulnerability within the xpmtoppm utility, specifically affecting versions prior to 10.86.51, 11.x prior to 11.02.30, and 11.03 prior to 11.15.08. This flaw originates from an insufficient validation of the characters-per-pixel field found in the header of XPM (X PixMap) image files. The vulnerability allows attackers to craft malicious input that exploits this lack of bounds checking, leading to memory corruption when the utility attempts to process the malformed data structure.
From a technical perspective, the root cause lies in how xpmtoppm handles color name hashing during the parsing of XPM headers. The application allocates fixed-size hash entries intended for standard pixel representations where each character corresponds to a single pixel value or a small set of values. However, when an attacker supplies an XPM file with a characters-per-pixel value greater than three, the utility fails to verify that this count aligns with the allocated buffer size. Consequently, the processing logic writes beyond the boundaries of these fixed 3-byte color name hash entries into adjacent memory regions on the heap. This out-of-bounds write operation constitutes a classic heap-based buffer overflow, which disrupts the integrity of surrounding data structures and control flow mechanisms within the application's memory space.
The operational impact of this vulnerability is severe due to its potential for remote code execution. While immediate exploitation may result in application crashes or denial of service conditions through segmentation faults, sophisticated attackers can leverage the heap corruption to overwrite function pointers or return addresses stored nearby in memory. By carefully crafting the payload within the XPM file, an attacker could achieve arbitrary code execution with the privileges of the user running the xpmtoppm utility. This is particularly dangerous in environments where image processing services are exposed to untrusted input sources, such as web applications that accept uploaded images or automated pipelines that process external media files without rigorous sanitization.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) identifiers for Improper Limitation of a Pathname to a Restricted Directory and specifically CWE-120 Buffer Copy without Checking Size of Input, which describes the buffer overflow condition itself. In terms of adversarial tactics, this flaw can be exploited using techniques associated with MITRE ATT&CK subcategories related to Exploitation for Execution via Memory Corruption. The attack vector typically involves tricking a victim into opening or processing a specially crafted XPM file, often delivered through phishing emails or malicious websites that host the exploit payload as an image attachment or embedded resource.
Mitigation strategies primarily involve upgrading Netpbm to version 10.86.51 or later for older branches, and specifically versions 11.02.30 or higher for the 11.x branch, along with any release of the 11.03 series that is equal to or newer than 11.15.08. These updated releases include patches that enforce strict validation on the characters-per-pixel value before allocating memory or processing hash entries. For organizations unable to immediately patch their systems, defensive measures should include implementing input sanitization at the network perimeter or application layer to reject XPM files with non-standard header values. Additionally, enabling heap protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) can mitigate the likelihood of successful code execution by making memory layout unpredictable and preventing executable code from running in data regions.