Netpbm rasttopnm EUVD-2026-104297

Requires that rasttopnm (the Sun rasterfile-to-PNM converter) be invoked on an attacker-controlled, colormapped Sun rasterfile in which pixel index bytes exceed the supplied colormap/palette length. Exploitation is gated by user interaction (UI:P): a user or an automated workflow must actually feed the malicious rasterfile to rasttopnm - there is no remote unauthenticated self-triggering path. The impact is limited to a bounded heap over-read (≤255 adjacent bytes) disclosed into PNM output or a crash; it does not grant code execution or memory writes. Practical exposure is highest where Netpbm auto-converts untrusted uploaded images; systems that never process Sun rasterfiles through rasttopnm are effectively not exposed.

This is a moderate, defensively-relevant issue rather than a top-tier emergency. The input CVSS 4.0 vector (6.9) models local exploitation (AV:L) with no privileges (PR:N) but passive user interaction (UI:P) - i.e., a victim must run rasttopnm against an attacker-supplied Sun rasterfile. The dominant impact is availability (VA:H, crash from an out-of-bounds read) with only limited confidentiality (VC:L, leaking up to 255 adjacent heap bytes into PNM output); there is no integrity impact (VI:N), consistent with CWE-125 (out-of-bounds read). No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so there is no signal of active exploitation or automatable mass exploitation; SSVC-style exploitation status is therefore 'none' by the available data. The heap leak is bounded and non-deterministic (adjacent bytes, not attacker-chosen targets), limiting its value for reliable secret exfiltration. One nuance to verify: the referenced write-up URL (hackmd '...sunraster-rle-oob-write-palette-oob-read') implies a related OOB WRITE also exists in the same code path, but THIS CVE is scoped to the palette OOB read only - do not conflate the two when prioritizing. Overall: a real but lower-urgency bug, most relevant where Netpbm processes untrusted image uploads in an automated pipeline.

An attacker crafts a colormapped Sun rasterfile whose pixel bytes reference indices beyond the short colormap length and submits it to a system that converts it with rasttopnm (e.g., an image-processing pipeline or a user running the tool manually). When converted, the tool reads past the palette into adjacent heap memory, either leaking up to 255 bytes of that memory into the resulting PNM output or crashing the process. A technical write-up describing the flaw is referenced, but no packaged public exploit code was indicated in the provided data.