CVE-2026-120432

A flaw was found in Netpbm. An integer overflow in the winicontopam utility occurs when processing icon or cursor files with excessively large dimensions. By tricking a user or system into processing a specially crafted file, an attacker could corrupt memory, potentially leading to arbitrary code execution or a Denial of Service (DoS) crash.

This vulnerability is rated as an Important severity issue for Red Hat Enterprise Linux because successful exploitation allows an attacker to achieve arbitrary code execution or cause an application crash with the privileges of the executing process. The affected winicontopam binary is a short-lived command-line conversion utility rather than a persistent network daemon, meaning exposure is limited to systems where users or automated ingestion pipelines process untrusted Windows icon or cursor files. Standard server deployments that do not handle untrusted graphical assets or that omit the optional command-line utilities package remain unaffected during typical operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.