Is CVE-2026-120435 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120435 being exploited in the wild.

How severe is CVE-2026-120435?

High severity, with a CVSS score of 7.8, published 2 November 2026.

Which products and versions are affected?

Netpbm before 10.86.51, 11.x before 11.02.30, 11.03 before 11.15.08.

Is there a fix for CVE-2026-120435?

Yes: fixed in Netpbm 10.86.51, 11.02.30, 11.15.08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120435 attacked?

It is attacked with local access.

Am I affected by CVE-2026-120435?

Check whether you run Netpbm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120435: Netpbm heap buffer overflow in xpmtoppm

CVE-2026-120435 · Severity: high · CVSS 7.8 · Published 2026-11-02

Netpbm is a suite of graphics conversion tools that includes xpmtoppm, which converts XPM image files to PPM format. A heap buffer overflow in xpmtoppm can be triggered by supplying a crafted XPM file with an invalid characters-per-pixel value, potentially allowing an attacker to crash the application or execute arbitrary code.

Technologies: Netpbm. Vendors: Netpbm.

Quick answers

Is CVE-2026-120435 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120435 being exploited in the wild.
How severe is CVE-2026-120435?: High severity, with a CVSS score of 7.8, published 2 November 2026.
Which products and versions are affected?: Netpbm before 10.86.51, 11.x before 11.02.30, 11.03 before 11.15.08.
Is there a fix for CVE-2026-120435?: Yes: fixed in Netpbm 10.86.51, 11.02.30, 11.15.08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120435 attacked?: It is attacked with local access.
Am I affected by CVE-2026-120435?: Check whether you run Netpbm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Netpbm 10.86.51, 11.02.30, 11.15.08

Technical details

The xpmtoppm converter contains a heap buffer overflow vulnerability caused by insufficient validation of the characters-per-pixel (cpp) value in the XPM file header. When cpp exceeds 3, it causes overruns of fixed 3-byte colorName hash table entries (struct ColorNameHashTableEntry). The vulnerability is triggered by processing a malicious XPM file and can lead to memory corruption, denial of service, or code execution.

Affected products

Netpbm Netpbm before 10.86.51, 11.x before 11.02.30, 11.03 before 11.15.08

Timeline

2026-11-02: disclosed
2026-09-12: patched: Fix committed to repository (r5336)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.