Netpbm xpmtoppm CVE-2026-120435

Exploitation requires that xpmtoppm (the Netpbm XPM-to-PPM converter) be run against an attacker-supplied XPM file whose header specifies a characters-per-pixel value greater than 3; that oversized value is what overruns the fixed 3-byte colorName hash entries. Per the CVSS 4.0 vector this is local (AV:L) with passive user interaction (UI:P) and no privileges (PR:N), meaning the victim or an automated workflow must actually invoke the converter on the hostile file. Limiting factors: there is no remote or network-facing exposure by default, the specific xpmtoppm tool must be in use (not merely Netpbm being installed), and affected versions are those before 10.86.51, 11.02.30, and 11.15.08.

This is a locally-scoped memory-corruption flaw (CWE-787) with a genuinely high technical impact but a narrow trigger path, so it rates as a moderate real-world priority rather than an emergency. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, 8.5) is internally consistent with the description: exploitation is local and requires the victim to process an attacker-supplied XPM file through xpmtoppm (UI:P), not a remote network reach. The vendor priority label is 'this_week' and a patch is available, which argues for prompt but not drop-everything remediation. No EPSS probability was provided, the CVE is NOT listed in CISA KEV, and no confirmed public exploit code is present in the inputs - only vendor/commit references and a VulnCheck advisory. The description itself qualifies the impact as 'crashes or potentially code execution,' so the VC:H/VI:H/VA:H rating reflects a worst-case code-execution outcome that is plausible but not demonstrated in the supplied evidence. Net: a real issue worth patching this cycle, but the local-plus-user-interaction requirement and absence of KEV/EPSS/working-exploit signals place it below network-reachable unauthenticated RCE.

An attacker crafts a malicious XPM image whose header declares a characters-per-pixel value greater than 3 and delivers it to a victim (e.g., via email, a download, or an automated image-conversion pipeline). When the victim or a service runs xpmtoppm against the file, the oversized per-pixel value overruns the fixed 3-byte colorName hash entries on the heap, causing a crash or potentially arbitrary code execution. No public exploit identified at time of analysis; exploitation is local and depends on the target actually invoking the vulnerable converter on the crafted file.