CVE-2026-120436 — Vulnerability intelligence
—
Published:
- CVSS
- 8.5
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.