Is CVE-2026-120431 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120431 being exploited in the wild.

How severe is CVE-2026-120431?

High severity, with a CVSS score of 7.8, published 2 November 2026.

Which products and versions are affected?

Netpbm before 10.86.51, 11.x before 11.02.29, 11.03 before 11.15.07.

Is there a fix for CVE-2026-120431?

Yes: fixed in Netpbm 10.86.51, 11.02.29, 11.15.07. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120431 attacked?

It is attacked with local access or over the network, in a software library.

Am I affected by CVE-2026-120431?

Check whether you run Netpbm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120431: Netpbm heap-based buffer overflow in sgitopnm readChannels

CVE-2026-120431 · Severity: high · CVSS 7.8 · Published 2026-11-02

Netpbm is a suite of graphics conversion tools widely used for batch image processing. A heap-based buffer overflow in sgitopnm, which converts SGI image files to other formats, can be triggered by supplying a malicious SGI file with crafted RLE compression data. An attacker can crash the application or potentially execute arbitrary code.

Technologies: Netpbm. Vendors: Netpbm.

Quick answers

Is CVE-2026-120431 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120431 being exploited in the wild.
How severe is CVE-2026-120431?: High severity, with a CVSS score of 7.8, published 2 November 2026.
Which products and versions are affected?: Netpbm before 10.86.51, 11.x before 11.02.29, 11.03 before 11.15.07.
Is there a fix for CVE-2026-120431?: Yes: fixed in Netpbm 10.86.51, 11.02.29, 11.15.07. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120431 attacked?: It is attacked with local access or over the network, in a software library.
Am I affected by CVE-2026-120431?: Check whether you run Netpbm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Netpbm 10.86.51, 11.02.29, 11.15.07

Technical details

The readChannels() function in sgitopnm fails to properly validate the offset table length when processing RLE-compressed SGI images, allowing an attacker to write controlled data past the heap buffer boundary. The vulnerability is triggered by network or local supply of a crafted SGI file; no authentication or user interaction beyond opening the file is required. Successful exploitation leads to denial of service or arbitrary code execution with the privileges of the user running sgitopnm.

Affected products

Netpbm Netpbm before 10.86.51, 11.x before 11.02.29, 11.03 before 11.15.07

Timeline

2026-11-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.