{"id":"CVE-2026-112275","published":"2026-10-19T14:17:05.367","lastModified":"2026-10-19T21:14:14.150","description":"Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr_load_image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past md_image, causing memory corruption and crashes.","cvssScore":6.1,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://hackmd.io/@haindpwn/netpbm-sunraster-rle-oob-write-palette-oob-read","tags":[]},{"url":"https://netpbm.sourceforge.net/","tags":[]},{"url":"https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rast.c","tags":[]},{"url":"https://sourceforge.net/p/netpbm/code/5400/tree/super_stable/converter/other/rast.c","tags":[]},{"url":"https://www.vulncheck.com/advisories/netpbm-through-11.16.00-heap-out-of-bounds-write-via-rasttopnm-pr-load-image","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}