Netpbm EUVD-2026-115194

Exploitation requires the victim to run the picttoppm converter on an attacker-supplied PICT file whose polygon edges produce more than 5000 coordinate points, overflowing the fixed-size coord stack array in scanPoly(). This is a local vector (AV:L) with passive user interaction (UI:P): the attacker cannot trigger it remotely or without the target processing the malicious file. Limiting factors - the target environment must actually invoke picttoppm (a specific, non-default-service Netpbm tool) on untrusted PICT input, and affected versions are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08; patched versions are not affected.

This is a locally-exploitable, file-parsing memory-corruption flaw, not a remotely-reachable priority. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) confirms a local attack vector requiring user interaction (passive) rather than network reachability, so despite the 8.5 base score the real-world urgency is bounded by the need to get a victim to run picttoppm on an attacker-supplied PICT file. No EPSS score was provided in the input, and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; the vuln.today decision label is 'this_week', consistent with a patch-promptly-but-not-emergency posture. No PoC or exploit-code reference is present among the inputs (only a vendor patch, SVN history links, and the VulnCheck advisory), so exploitability toward code execution is described by the advisory as a possibility ('potentially execute code'), not demonstrated. Net: a genuine but lower-tier priority - treat as scheduled patching for environments that invoke picttoppm on untrusted PICT input, not an exposed-service emergency.

An attacker crafts a malicious PICT file whose polygon edges generate more than 5000 points and delivers it to a victim (e.g., via email, download, or an automated conversion pipeline). When picttoppm processes the file, scanPoly() overflows the fixed coord stack array, crashing the converter and potentially corrupting the stack toward code execution. No public exploit was identified in the provided data; execution beyond a crash is described by the advisory as potential, not demonstrated.