Netpbm CVE-2026-120432

Exploitation requires that winicontopam be invoked on an attacker-controlled ICO/CUR file whose declared width or height exceeds 32767 (the value that overflows the signed int16_t loop counters); this is the specific trigger named in the description. Because the vector is local (AV:L) with passive user interaction (UI:P), the attacker cannot trigger it remotely on their own - a user must run the converter, or a server-side/batch pipeline must feed untrusted icon files into it. Exploitation is therefore limited to environments that process untrusted ICO/CUR input with winicontopam on an affected version; the confirmed outcome is a crash, while arbitrary code execution is described only as a potential, non-demonstrated outcome.

The scoring signals point to a moderately serious but not emergency-grade issue. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) yields 8.5 (High), but the two metrics that most constrain real-world risk are AV:L and UI:P/UI:R: this is not a remotely reachable network service - an attacker must get the victim (or an automated pipeline) to run winicontopam against an attacker-supplied ICO/CUR file. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no data indicating active exploitation; exploitation status is 'no public exploit identified at time of analysis' (the references are the SourceForge patch commits, branch HISTORY files, and the VulnCheck advisory - i.e. fix/advisory material, not working exploit code). The vuln.today decision label is 'this_week', consistent with a High-severity local-impact bug that warrants prompt but not emergency patching. One point of tension to verify: the description states 'crashes or potential code execution,' so the VC:H/VI:H/VA:H impact rating reflects a potential RCE outcome, whereas the only clearly-established outcome from the heap corruption is a crash - treat the code-execution impact as plausible-but-unproven rather than confirmed.

An attacker crafts a malicious ICO or CUR file declaring a width or height greater than 32767 and delivers it to a victim or into an automated image-conversion pipeline that invokes winicontopam. When the tool parses the file, the oversized dimension wraps the int16_t loop counters negative, producing negative row-buffer indices and heap memory corruption that crashes the process and could potentially be leveraged for code execution. No public exploit code is identified at time of analysis; only vendor patch commits and the VulnCheck advisory are referenced.