p PatchFirst

CVE-2026-112275

CVE-2026-112275 · Netpbm through 11.16.00 Heap Out-of-Bounds Write via rasttopnm pr_load_image

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr_load_image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past md_image, causing memory corruption and crashes.

CVSS 6.9 · Medium · EPSS 0.1%

Published
Updated

Stack: system

Affected products and versions

  • netpbm

    Versions
    • ≥ 0, ≤ 11.16.00: Affected (custom)

    No fix published

  • netpbm-free Debian:12

    Versions
    • 2:11.01.00-2
    • 2:11.03.00-1
    • 2:11.03.00-2
    • 2:11.03.00-3
    • 2:11.03.06-1
    • 2:11.04.05-1
    • 2:11.04.05-2
    • 2:11.05.01-1
    • 2:11.05.01-2
    • 2:11.05.01-3
    • 2:11.05.02-1
    • 2:11.05.02-1.1
    • 2:11.05.02-1.1~exp1
    • 2:11.05.03-1
    • 2:11.06.00-1
    • 2:11.06.01-1
    • 2:11.06.01-2
    • 2:11.07.00-1
    • 2:11.07.00-2
    • 2:11.07.01-1
    • 2:11.08.00-1
    • 2:11.08.01-1
    • 2:11.08.02-1
    • 2:11.09.02-1
    • 2:11.09.02-2
    • 2:11.09.03-1
    • 2:11.10.02-1
    • 2:11.11.00-1
    • 2:11.11.00-2
    • 2:11.11.01-1
    • 2:11.12.00-1
    • 2:11.13.00-1
    • 2:11.13.00-2
    • 2:11.13.00-3
    • 2:11.13.03+ds-1
    • 2:11.13.03+ds-2
    • 2:11.13.03-1
    • 2:11.15.04+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netpbm-free Debian:13

    Versions
    • 2:11.10.02-1
    • 2:11.11.00-1
    • 2:11.11.00-2
    • 2:11.11.01-1
    • 2:11.12.00-1
    • 2:11.13.00-1
    • 2:11.13.00-2
    • 2:11.13.00-3
    • 2:11.13.03+ds-1
    • 2:11.13.03+ds-2
    • 2:11.13.03-1
    • 2:11.15.04+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netpbm-free Debian:14

    Versions
    • 2:11.10.02-1
    • 2:11.11.00-1
    • 2:11.11.00-2
    • 2:11.11.01-1
    • 2:11.12.00-1
    • 2:11.13.00-1
    • 2:11.13.00-2
    • 2:11.13.00-3
    • 2:11.13.03+ds-1
    • 2:11.13.03+ds-2
    • 2:11.13.03-1
    • 2:11.15.04+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netpbm-free Ubuntu:16.04:LTS

    Versions
    • 2:10.0-15.2
    • 2:10.0-15.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netpbm-free Ubuntu:18.04:LTS

    Versions
    • 2:10.0-15.3build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netpbm-free Ubuntu:20.04:LTS

    Versions
    • 2:10.0-15.3build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netpbm-free Ubuntu:22.04:LTS

    Versions
    • 2:10.0-15.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netpbm-free Ubuntu:24.04:LTS

    Versions
    • 2:11.01.00-2build1
    • 2:11.03.06-1
    • 2:11.04.05-2
    • 2:11.05.01-3
    • 2:11.05.02-1
    • 2:11.05.02-1.1
    • 2:11.05.02-1.1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netpbm-free Ubuntu:26.10

    Versions
    • 2:11.10.02-1build1
    • 2:11.13.03+ds-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netpbm-free Ubuntu:26.04:LTS

    Versions
    • 2:11.10.02-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →