CVE-2026-112276CWE-125

CVE-2026-112276

Medium · published October 19, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
9.0
In the wild
Unconfirmed
What it is

Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CVSS v4.0
6.9 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00197 · 9.0th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-10-19T18:17Z
References (6)
https://hackmd.io/@haindpwn/netpbm-sunraster-rle-oob-write-palette-oob-read · [email protected]https://netpbm.sourceforge.net/ · [email protected]https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rast.c · [email protected]https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rasttopnm.c · [email protected]https://www.vulncheck.com/advisories/netpbm-through-11.16.00-heap-out-of-bounds-read-via-rasttopnm-colormap · [email protected]https://hackmd.io/@haindpwn/cve-2026-112275-112276-netpbm-sunraster-rle-oob-write-palette-oob-read · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 13:55Z
    Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap
    cvelistv5
  • 19 OCT 13:55Z
    Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap
    cvelistv5