What is CVE-2026-120436 in Netpbm?
CVE-2026-120436 is a severe security flaw discovered in the Netpbm graphics manipulation package, rated with a CVSS base score of 7.8 vulnerabilidad crítica CVE-2026-115905. This issue stems from an integer overflow located within the jbigtopnm utility during the calculation of output buffer sizes.
When processing a specifically crafted multi-plane JBIG file featuring excessively large header dimensions, the function jbg_dec_merge_planes() writes data beyond the boundaries of an undersized buffer. This flaw is officially documented in details by CVE-2026-58946 tracking mechanisms and references at CVE-2026-58957.
Who is affected by this heap buffer overflow?
Systems utilizing Netpbm branches prior to version 10.86.51, version 11.x prior to 11.02.30, and version 11.03 prior to 11.15.08 are vulnerable [[reference:1|NIST NVD]]. Attackers can exploit this by enticing users or automated pipelines to process malicious image files.
Successful exploitation can result in application crashes, denial of service conditions, or potentially arbitrary code execution within the context of the user running the conversion tool [[reference:8|Referencia técnica en vulncheck.com]].
How do I protect my systems?
To secure your environment against this vulnerability, system administrators and developers must upgrade their Netpbm packages immediately to the fixed versions [[reference:3|Referencia técnica en sourceforge.net]].
You can verify the current version or apply updates using your system package manager or by compiling the patched source code [[reference:2|CVE-2026-120436 en CVE.org]].
- Identify the installed version of Netpbm across your servers and workstations.
- Upgrade the package to version 10.86.51, 11.02.30, 11.15.08, or higher depending on your deployment tree.
- Validate that image processing pipelines reject malformed or untrusted multi-plane JBIG files.