CVE-2026-120433

A flaw was found in Netpbm. This vulnerability allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by tricking a user or system into processing a specially crafted image file. A lack of boundary checking in the picttoppm utility allows a polygon with an excessive point count in a QuickDraw Picture (PICT) file to overflow a stack buffer.

Red Hat Product Security rates this vulnerability as Important because an attacker can potentially execute arbitrary code or trigger an application crash within the privileges of the executing process. Exploitation requires user interaction or an automated ingestion pipeline that passes untrusted Apple QuickDraw graphic data to the standalone conversion tool. While the affected binary is not an active network service by default, environments running server-side file transformation workflows or multi-user systems where users process external graphics are directly exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.