Netpbm rasttopnm CVE-2026-112275

Exploitation requires the victim (or an automated pipeline) to invoke rasttopnm on an attacker-supplied Sun rasterfile that is byte/run-length encoded (RT_BYTE_ENCODED) and specially crafted with tiny declared dimensions combined with an oversized run-length body, triggering the OOB write in the pr_load_image RLE decoder. Limiting factors: the attack is local (AV:L) and demands user interaction (UI:P) - the attacker cannot reach the parser remotely without the victim processing the file, so risk is confined to environments where untrusted .ras images are converted. No authentication or special privileges are needed (PR:N), and default behavior of the converter is sufficient once a malicious file is fed in.

This is a legitimately MEDIUM-severity issue, not an overhyped critical. The provided CVSS 4.0 score of 6.9 is driven by local attack vector (AV:L), low complexity (AC:L), no privileges (PR:N), but required passive user interaction (UI:P) and an impact profile dominated by availability (VA:H) with only limited integrity impact (VI:L) and no confidentiality impact (VC:N). In practice this means a victim must be induced to convert an attacker-supplied Sun rasterfile with rasttopnm; it is not remotely reachable without that step. No EPSS score and no KEV status were provided, so there is no signal of active or widespread exploitation - consistent with a file-format parser bug rather than a mass-exploited network service flaw. A detailed public technical writeup (hackmd) describing the exact crafting method exists, which materially lowers the bar to reproduction, but no formal weaponized exploit or active-exploitation evidence was supplied. The realistic risk is denial of service / crash with a plausible but non-trivial path toward controlled memory corruption; the write is described as 'controlled bytes past md_image,' so while CVSS rates integrity only Low, heap OOB writes of controlled data can sometimes escalate - defenders should treat RCE as unproven but not dismiss it. Net: a real but not top-tier priority, appropriate for routine patching of image-processing pipelines rather than emergency response.

An attacker crafts a malicious byte-encoded (RT_BYTE_ENCODED) Sun rasterfile declaring tiny image dimensions but carrying a long run-length-encoded body, then delivers it to a victim or an automated pipeline. When rasttopnm decodes the file via pr_load_image, the RLE decoder writes attacker-controlled bytes past the allocated md_image buffer, corrupting the heap and crashing the process. A public technical writeup documents the crafting technique, so reproduction is straightforward for a motivated attacker.