Is CVE-2026-120436 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120436 being exploited in the wild.

How severe is CVE-2026-120436?

High severity, with a CVSS score of 7.8, published 2 November 2026.

Which products and versions are affected?

Netpbm before 10.86.51, 11.x before 11.02.30, 11.03 before 11.15.08.

Is there a fix for CVE-2026-120436?

Yes: fixed in Netpbm 10.86.51, 11.02.30, 11.15.08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120436 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120436?

Check whether you run Netpbm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120436: Netpbm jbigtopnm integer overflow heap buffer overflow

CVE-2026-120436 · Severity: high · CVSS 7.8 · Published 2026-11-02

Netpbm is a suite of graphics conversion tools used to transform images between different formats. A flaw in the jbigtopnm converter allows attackers to craft malicious JBIG image files that trigger a heap buffer overflow when processing, potentially leading to application crashes or arbitrary code execution on systems that process untrusted image files.

Technologies: Netpbm. Vendors: Netpbm.

Quick answers

Is CVE-2026-120436 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120436 being exploited in the wild.
How severe is CVE-2026-120436?: High severity, with a CVSS score of 7.8, published 2 November 2026.
Which products and versions are affected?: Netpbm before 10.86.51, 11.x before 11.02.30, 11.03 before 11.15.08.
Is there a fix for CVE-2026-120436?: Yes: fixed in Netpbm 10.86.51, 11.02.30, 11.15.08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120436 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120436?: Check whether you run Netpbm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Netpbm 10.86.51, 11.02.30, 11.15.08

Technical details

An integer overflow in jbigtopnm's jbg_dec_merge_planes() function occurs during output buffer size computation when handling multi-plane JBIG files. Attackers can provide a crafted JBIG file with large header dimensions (XD/YD fields) to cause the buffer allocation to be undersized, resulting in a heap buffer overflow. This requires the victim to process a malicious JBIG file via jbigtopnm.

Affected products

Netpbm Netpbm before 10.86.51, 11.x before 11.02.30, 11.03 before 11.15.08

Timeline

2026-11-02: disclosed
2026-09-08: patched: Fix applied in commit r5324

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.