EUVD-2026-115193
GHSA-9ccj-5rg6-rhvw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted PICT file to victim
-
DeliveryVictim runs picttoppm conversion
-
ExploitPolygon exceeds 100-point limit in paintPoly()
-
ExecutionOverflow fixed pts array on stack
-
ImpactCrash or potential code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that picttoppm (the Netpbm PICT-to-PPM converter) be invoked on an attacker-controlled PICT file whose polygon contains more than 100 points, overflowing the fixed-size pts array in paintPoly(). Limiting factors: the CVSS vector is AV:L with UI:P, so the attack is local and depends on a user or automated process actually opening/converting the malicious file - there is no remote or network-triggered path and no standing service to attack; exposure is therefore confined to systems that run picttoppm on untrusted PICT input (e.g., image-conversion services or users processing received files). Affected only on Netpbm versions before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08. |
| Impact | This is a genuine but moderate-urgency issue rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scores 8.5 and describes a LOCAL attack vector that requires passive user interaction - the victim must run picttoppm on an attacker-supplied PICT file - so this is not remotely reachable network RCE despite the 'RCE' tag. There is no CISA KEV listing and no EPSS score in the supplied data, so widespread or confirmed active exploitation is not indicated; the vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious-but-not-fire-drill priority. No exploit/PoC reference is present in the input (only patch commits, HISTORY files, the vulnerable source file, and the VulnCheck advisory), so no public exploit is identified. The description itself hedges impact ('crashes or potentially code execution'), so reliable code execution is unconfirmed - the realistic baseline impact is a denial-of-service crash of the conversion process, with RCE as a plausible-but-unverified upside. Note the tags label this 'RCE' while CVSS is local-only with required user interaction; treat the RCE characterization as potential, not demonstrated. |
| Exploit ScenarioDerived | An attacker crafts a malicious PICT image containing a polygon with more than 100 points and delivers it to a victim (e.g., via email, download, or an automated image-conversion pipeline). When the victim or a server-side process runs picttoppm on the file, paintPoly() writes past the fixed-size pts array on the stack, crashing the tool and potentially enabling code execution in the context of the processing user. No public exploit code was identified in the supplied sources, so weaponization is not confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Stack-based buffer overflow in Netpbm's picttoppm PICT-to-PPM converter lets an attacker who supplies a crafted PICT file containing a polygon with more than 100 points overwrite the fixed-size pts array in paintPoly(), crashing the converter and potentially achieving code execution in the context of the converting process. Only Netpbm builds before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 are affected, and exploitation requires picttoppm to actually be run on the malicious file (CVSS AV:L with UI:P), so exposure is limited to users and automated image-conversion pipelines that process untrusted PICT input. Vendor fixes are published for all three branches; no public exploit code was identified at time of analysis, and the case is triaged as this_week rather than an emergency.
RemediationAI
Vendor-released patch: upgrade to Netpbm 10.86.51 (stable branch), 11.02.30 (advanced/11.x branch), or 11.15.08 (11.03 branch), matching whichever release line is deployed; the fix commit is https://sourceforge.net/p/netpbm/code/5328/ and branch history is documented in the stable, advanced, and super_stable HISTORY links above, with further detail in the VulnCheck advisory at https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-buffer-overflow-via-paintpoly. Because exploitation only occurs when picttoppm processes a malicious PICT file and requires user or automated invocation (AV:L / UI:P), deployments that cannot immediately upgrade should restrict conversion of untrusted PICT input - for example by quarantining PICT files received from external parties or gating the picttoppm step in automated pipelines to vetted sources - until the fixed version is installed, accepting reduced PICT conversion coverage as the trade-off.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Netpbm is a long-standing collection of command-line image conversion utilities, and picttoppm is the component that parses Apple PICT files and emits PPM output. The flaw is a classic CWE-121 stack-based buffer overflow: the paintPoly() routine in converter/ppm/picttoppm.c stores polygon vertices into a fixed-size pts array without validating the point count declared in the PICT stream, so a polygon exceeding 100 points writes past the end of that stack buffer. The result is memory corruption in the converter process, manifesting first as a crash and potentially as controlled code execution depending on stack layout and build hardening. The affected package is identified by CPE cpe:2.3:a:netpbm:netpbm:*:*:*:*:*:*:*:*, and the upstream fix landed as sourceforge commit 5328 with corresponding history entries on the stable, advanced, and super_stable branches, confirming the defect was carried across all maintained release lines. The trigger is file-format parsing, not a network service, so the practical attack surface is any workflow that hands an attacker-influenced PICT file to picttoppm.
Know when Netpbm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
The flaw triggers only when a user runs picttoppm on a malicious local file, so AV:L and UI:R with PR:N; a successful stack overflow can plausibly yield full process compromise, hence C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.
Executive ViewAI
A high-severity buffer overflow in Netpbm's picttoppm tool can be triggered by a crafted PICT image, potentially allowing code execution on systems that process untrusted PICT files. This poses a risk to teams using automated image conversion pipelines or handling external image uploads, as a successful exploit could lead to unauthorized access or service disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers
The pm_mallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03 allows remote attackers to cause a denia
Heap buffer overflow in Netpbm's jbigtopnm converter allows a crafted multi-plane JBIG file with large header dimensions
Heap buffer overflow in Netpbm's xpmtoppm converter allows an attacker who supplies a crafted XPM file with a characters
Stack-based buffer overflow in Netpbm's picttoppm converter allows a crafted PICT file to overflow the fixed-size coord
Heap memory corruption in Netpbm's winicontopam converter affects releases before 10.86.51, 11.02.30, and 11.15.08, wher
Heap-based buffer overflow in Netpbm's sgitopnm converter affects releases before 10.86.51, 11.x before 11.02.29, and 11
Out-of-bounds read in Netpbm's tgatoppm converter allows a crafted color-mapped Targa file to crash the tool or leak adj
Heap out-of-bounds read in Netpbm's rasttopnm converter through 11.16.00 can expose up to 255 adjacent heap bytes in gen
Heap-based out-of-bounds write in Netpbm's rasttopnm Sun rasterfile decoder (pr_load_image) allows an unauthenticated lo
Exploit-DB