VulnFeed.org: Netpbmhttps://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enCVE-2026-120434: Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Overflow via scanPolyhttps://vulnfeed.org/cve/CVE-2026-120434/https://vulnfeed.org/cve/CVE-2026-120434/Mon, 02 Nov 2026 15:17:25 +0000Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly() function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack array to crash the converter or potentially execute code.CVE-2026-120435: Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppmhttps://vulnfeed.org/cve/CVE-2026-120435/https://vulnfeed.org/cve/CVE-2026-120435/Mon, 02 Nov 2026 15:17:25 +0000Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte colorName hash entries, causing crashes or potentially code execution.CVE-2026-120436: Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnmhttps://vulnfeed.org/cve/CVE-2026-120436/https://vulnfeed.org/cve/CVE-2026-120436/Mon, 02 Nov 2026 15:17:25 +0000Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.CVE-2026-120431: Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflowhttps://vulnfeed.org/cve/CVE-2026-120431/https://vulnfeed.org/cve/CVE-2026-120431/Mon, 02 Nov 2026 15:17:24 +0000Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution.CVE-2026-120432: Netpbm before 10.86.51, 11.02.30, and 11.15.08 Integer Overflow in winicontopamhttps://vulnfeed.org/cve/CVE-2026-120432/https://vulnfeed.org/cve/CVE-2026-120432/Mon, 02 Nov 2026 15:17:24 +0000Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16_t loop counters into negative row buffer indices to cause crashes or potential code execution.CVE-2026-120433: Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPolyhttps://vulnfeed.org/cve/CVE-2026-120433/https://vulnfeed.org/cve/CVE-2026-120433/Mon, 02 Nov 2026 15:17:24 +0000Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.