Netpbm EUVD-2026-115240

Exploitation requires that sgitopnm (the SGI-to-PNM converter in Netpbm) process a crafted RLE-compressed SGI image whose offset table length is oversized; this specific code path in readChannels() must be reached, so non-RLE or uncompressed SGI handling is not implicated. Per the CVSS vector, the attack is local (AV:L) and requires user interaction (UI:P) - a user or automated job must invoke sgitopnm on the attacker-supplied file - which limits exploitation to scenarios where untrusted SGI files are converted. PR:N means no prior authentication or privileges are needed on the parsing side. The principal limiting factor is delivery and trigger: there is no remote/network vector and no autonomous exploitation; realistic risk is highest where Netpbm is wired into automated image-processing pipelines that accept untrusted input.

This is a genuine but context-dependent risk, not an internet-facing emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scores 8.5 because successful exploitation yields high confidentiality, integrity, and availability impact - consistent with a heap-based buffer overflow (CWE-122) that can corrupt the heap and potentially lead to code execution. However, the vector is LOCAL (AV:L) and requires user interaction (UI:P), meaning an attacker cannot reach this remotely or autonomously; a victim must process a crafted SGI file with the sgitopnm converter. The input provides no EPSS score and no KEV listing, so there is no signal of active exploitation or high exploitation probability. No SSVC exploitation/automatable fields are supplied beyond the vendor-style 'this_week' priority label. Exploitation status is: no public exploit identified at time of analysis (the references are patch and advisory links, not PoC/exploit code). Net assessment: a real, patch-worthy memory-corruption flaw whose realistic impact hinges on whether sgitopnm processes attacker-supplied files in an automated pipeline; absent KEV/EPSS data it is a prioritized-but-not-critical fix, aligning with the 'this_week' decision label.

An attacker crafts a malicious RLE-compressed SGI image with an oversized offset table length and delivers it to a victim or a conversion pipeline. When sgitopnm's readChannels() processes the file, it writes controlled data past the heap buffer, crashing the converter or potentially executing attacker-controlled code in the context of the user or service running sgitopnm. No public exploit code is identified at time of analysis, and a user or automated job must actually invoke sgitopnm on the file (UI:P, local vector).