Netpbm CVE-2026-120436

Exploitation requires a victim (or an automated service) to run the jbigtopnm converter on an attacker-supplied, crafted multi-plane JBIG file whose header specifies large dimensions; those dimensions overflow the integer computation of the output buffer size, so the undersized heap buffer is then overrun by jbg_dec_merge_planes(). Limiting factors: the attack vector is local (AV:L) - there is no remote network-service trigger, so the file must be fed to the tool through the JBIG-to-PNM conversion path; user interaction is required (UI:P) to process the file; no authentication or privileges are needed (PR:N); and only versions before 10.86.51, 11.02.30, and 11.15.08 are affected.

CVSS 4.0 rates this 8.5 (High), but the metrics tell a tempered story: AV:L means there is no remote network trigger - an attacker cannot reach jbigtopnm over a socket, so exploitation hinges on getting a victim or an automated pipeline to process a crafted JBIG file (UI:P). PR:N confirms no privileges are needed once the file is processed, and VC:H/VI:H/VA:H reflect the worst-case code-execution outcome, though the description qualifies this as 'potentially code execution' - crashes (denial of service) are the confirmed impact, RCE is plausible but not demonstrated. No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit code is referenced - only a patch commit, HISTORY entries and a VulnCheck advisory. The vendor-assigned priority 'this_week' aligns with these signals: a genuine memory-corruption bug worth patching promptly, but not an actively-exploited emergency. Net: a real, patch-worthy integer-overflow flaw whose practical risk is gated by the local vector and the requirement that someone run the vulnerable converter on hostile input - most dangerous to services that auto-convert untrusted JBIG uploads.

An attacker crafts a multi-plane JBIG file with oversized header dimensions and delivers it to a target (e.g. as an email attachment or an upload to a server-side image-conversion pipeline). When the victim or an automated service runs jbigtopnm on the file, the integer overflow in the output-buffer size computation yields an undersized heap allocation that jbg_dec_merge_planes() then overflows, crashing the process or potentially executing attacker code. No public exploit identified at time of analysis.