Netpbm tgatoppm CVE-2026-120437

Exploitation requires the victim (or an automated workflow) to run the netpbm tgatoppm converter on an attacker-supplied, color-mapped Targa file; the file must be color-mapped and must contain pixel values whose indexes exceed the declared color-map bounds, which is what drives the unchecked read in get_pixel(). Limiting factors: the attack is local (AV:L) and needs victim-initiated processing (UI:P) - it is not remotely or autonomously triggerable unless a service automatically feeds untrusted TGA files to tgatoppm. Affected builds are netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08; the only complete fix stated in the evidence is updating to the fixed versions.

This is a moderate-priority issue, not an emergency. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N, score 6.9) describes a local attack vector requiring passive user interaction - the victim must run the tgatoppm converter on an attacker-supplied file - rather than remote network exploitation. Impact is skewed toward availability (VA:H, a converter crash via out-of-bounds read) with only low confidentiality loss (VC:L, adjacent memory leaked into the output image) and no integrity impact. The vuln.today decision label is 'this_month,' consistent with a real-but-not-urgent fix, and the finding was reported by VulnCheck. No CISA KEV listing and no EPSS score are present in the input, so there is no signal of active or probable widespread exploitation; absence of these is not evidence of safety but does argue against emergency treatment. There is no confirmed public exploit code in the input - the references are the vendor patch, SVN HISTORY entries, the vulnerable source file, and a VulnCheck advisory, none verified as a working exploit. Net: a legitimate memory-safety bug worth patching this cycle, but its local vector and reliance on victim-initiated file processing keep real-world risk well below what a raw severity number alone might suggest.

An attacker crafts a malicious color-mapped Targa (TGA) image whose pixel values reference color-map indexes beyond the declared bounds and delivers it to a victim or an automated image-processing pipeline that invokes tgatoppm. When the file is converted, get_pixel() performs an out-of-bounds read, crashing the converter (denial of service) or leaking adjacent heap/stack memory into the produced PPM output. No public exploit code is identified in the input; exploitation requires the victim to process the file (UI:P).