---
id: CVE-2026-112276
title: Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap
summary: >-
  Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in
  rasttopnm that allows attackers to read heap memory by supplying Sun
  rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles
  with pixel byt…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: Netpbm
product: Netpbm
affected:
  - Netpbm <= 11.16.00
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T14:13:20.015700Z'
exploitAvailable: true
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T14:13:40.705Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112276'
references:
  - url: >-
      https://hackmd.io/@haindpwn/netpbm-sunraster-rle-oob-write-palette-oob-read
  - url: >-
      https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rasttopnm.c
  - url: >-
      https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rast.c
  - url: 'https://netpbm.sourceforge.net/'
  - url: >-
      https://www.vulncheck.com/advisories/netpbm-through-11.16.00-heap-out-of-bounds-read-via-rasttopnm-colormap
    label: >-
      VulnCheck Advisory: Netpbm through 11.16.00 Heap Out-of-Bounds Read via
      rasttopnm Colormap
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-19T14:30:01.063Z'
---

## Overview

Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program.

## Affected

- `Netpbm <= 11.16.00`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.