SECURITYHIGHCVE-2026-120434

CVE-2026-120434 — Netpbm picttoppm Stack-Based Buffer Overflow

Netpbm's picttoppm converter overflows a fixed-size stack array when a crafted PICT file yields over 5,000 polygon points (CVSS 7.8). Update Netpbm.

Dylan H.

Security Team

November 3, 2026
3 min read
CVE-2026-120434 — Netpbm picttoppm Stack-Based Buffer Overflow

Affected Products

  • Netpbm before 10.86.51
  • Netpbm 11.x before 11.02.30
  • Netpbm 11.03 before 11.15.08

Executive Summary

CVE-2026-120434 is a stack-based buffer overflow in the scanPoly() function of picttoppm (converter/ppm/picttoppm.c), part of the widely bundled Netpbm image-processing toolkit. An attacker who can get a victim or an automated pipeline to convert a specially crafted PICT file can overflow a fixed-size coordinate array on the stack.

CVSS Score: 7.8 (High)

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-120434
CVSS Score7.8 (High)
TypeStack-based buffer overflow
ComponentscanPoly() in converter/ppm/picttoppm.c
TriggerCrafted PICT file with polygon edges producing more than 5,000 points
Published2026-11-02

Affected Versions

Netpbm BranchVulnerableFixed
10.xBefore 10.86.5110.86.51 or later
11.0x – 11.0211.x before 11.02.3011.02.30 or later
11.03Before 11.15.0811.15.08 or later

Technical Analysis

The scanPoly() routine rasterizes polygons read from a PICT file. It stores edge coordinates in a fixed-size coord stack array sized for 5,000 points. A crafted file whose polygon edges produce more than 5,000 points writes past the end of that array, corrupting adjacent stack memory.

Stack corruption of this kind can crash the converter and, depending on compiler hardening and platform mitigations, may be leveraged for code execution in the context of the user running the tool. The NVD score of 7.8 reflects a local attack vector with user interaction (opening or converting a malicious file).

Where Netpbm Is Commonly Used

  • Image-conversion steps in document and web pipelines (thumbnailers, upload processors)
  • Legacy scripts that convert Macintosh PICT images
  • Packages that depend on the Netpbm tools through the OS package manager

Remediation

  1. Upgrade Netpbm to 10.86.51, 11.02.30, or 11.15.08 (or later), matching your branch.
  2. Check distribution packages. Most Linux distributions ship Netpbm as netpbm; apply your vendor's update when it lands.
# Check installed version
pnmfile --version 2>&1 | head -1
picttoppm --version 2>&1 | head -1
 
# Debian/Ubuntu
apt list --installed 2>/dev/null | grep -i netpbm
 
# RHEL/Fedora
rpm -q netpbm
  1. Restrict untrusted PICT input. If you cannot patch immediately, do not run picttoppm on files from untrusted sources, and remove it from automated upload-processing pipelines.
  2. Sandbox conversions. Run image converters under a low-privilege user, container, or seccomp profile.

Detection

IndicatorDescription
picttoppm crashes (SIGSEGV, stack smashing detected)Possible exploitation attempt or malformed input
Unexpected PICT files in upload directoriesDelivery of crafted input
Child processes spawned by image-conversion servicesPost-exploitation behavior

References