CVE-2026-120436 in Netpbm
Summary
by MITRE • 11/02/2026
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified within Netpbm versions prior to 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 represents a critical security flaw located in the jbigtopnm utility component of the suite. This specific function is responsible for converting JBIG (Joint Bi-level Image Group) format images into Netpbm formats such as PNM or PNG, which are widely used in image processing pipelines and document conversion workflows. The core technical defect stems from an integer overflow that occurs during the calculation of the output buffer size required to hold the decoded pixel data. When jbigtopnm processes a JBIG file, it must allocate memory for the resulting bitmap based on dimensions specified within the file header. Due to insufficient validation or improper arithmetic handling in the source code, specifically involving large values provided by an attacker-controlled input, the calculation of this buffer size wraps around or results in a significantly smaller value than actually required. This miscalculation leads directly to a heap-based buffer overflow condition when the subsequent decoding operation attempts to write pixel data into the undersized memory allocation.
The operational impact of this vulnerability is severe because it allows for arbitrary code execution under certain conditions, although denial of service via application crash is also a likely outcome depending on how the operating system handles the memory corruption and whether exploit mitigation techniques like ASLR or DEP are in place. An attacker can craft a malicious multi-plane JBIG file containing header dimensions that trigger this integer overflow during the buffer size computation phase. When jbg_dec_merge_planes, an internal function responsible for merging multiple planes of data into a single output stream, executes with these parameters, it writes beyond the bounds of the allocated heap memory. This out-of-bounds write can corrupt adjacent heap metadata or overwrite critical control structures such as return addresses on the stack if they reside in nearby memory regions, thereby enabling remote code execution if the vulnerable application is run by an unprivileged user and processes untrusted input from a network source or malicious file attachment.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound, which describes the error where arithmetic operations result in a value that exceeds the maximum limit of the data type used to store it. This overflow subsequently leads to CWE-787 Out-of-bounds Write, as the program writes data past the end of a buffer allocated on the heap. In terms of adversarial tactics and techniques, this exploit scenario maps closely to ATT&CK technique T1203 Exploitation for Client Execution, where attackers leverage vulnerabilities in client-side applications or utilities that process user-provided files to gain initial access or execute malicious payloads. The multi-plane nature of JBIG allows for complex structures that can be manipulated to maximize the likelihood of triggering the overflow condition reliably across different system architectures and compiler optimizations.
Mitigation strategies primarily involve upgrading Netpbm to version 10.86.51, 11.02.30, or 11.15.08 respectively, where these integer arithmetic checks have been corrected to prevent the buffer size miscalculation. For environments unable to immediately patch, defensive measures should include implementing strict input validation on JBIG files before they are processed by jbigtopnm, such as limiting maximum header dimensions or validating file structure integrity using specialized parsers that enforce safe bounds. Additionally, deploying runtime application self-protection mechanisms and ensuring modern memory protection features like Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) are enabled can significantly reduce the probability of successful exploitation by making it harder for attackers to predict memory layouts or execute injected code from heap regions.