CVE-2026-112276

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112276", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-19T13:25:29.280Z", "datePublished": "2026-10-19T13:55:22.723Z", "dateUpdated": "2026-10-19T14:13:40.705Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-19T13:55:22.723Z"}, "datePublic": "2026-10-17T18:49:38.000Z", "title": "Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap", "descriptions": [{"lang": "en", "value": "Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Read", "cweId": "CWE-125", "type": "CWE"}]}], "affected": [{"vendor": "Netpbm", "product": "Netpbm", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "11.16.00", "status": "affected", "versionType": "custom"}], "collectionURL": "https://sourceforge.net/p/netpbm/code/", "repo": "https://sourceforge.net/p/netpbm/code/"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*", "versionEndIncluding": "11.16.00"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://hackmd.io/@haindpwn/netpbm-sunraster-rle-oob-write-palette-oob-read", "tags": ["third-party-advisory"]}, {"url": "https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rasttopnm.c", "tags": ["technical-description"]}, {"url": "https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rast.c", "tags": ["technical-description"]}, {"url": "https://netpbm.sourceforge.net/", "tags": ["product"]}, {"name": "VulnCheck Advisory: Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/netpbm-through-11.16.00-heap-out-of-bounds-read-via-rasttopnm-colormap"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://hackmd.io/@haindpwn/cve-2026-112275-112276-netpbm-sunraster-rle-oob-write-palette-oob-read", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-19T14:13:20.015700Z", "id": "CVE-2026-112276", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T14:13:40.705Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-112276", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-19T14:13:20.015700Z"}}}], "references": [{"url": "https://hackmd.io/@haindpwn/cve-2026-112275-112276-netpbm-sunraster-rle-oob-write-palette-oob-read", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T14:13:36.276Z"}}], "cna": {"title": "Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap", "credits": [{"lang": "en", "type": "finder", "value": "HaiND from the Post and Telecommunication Institute of Technology"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"repo": "https://sourceforge.net/p/netpbm/code/", "vendor": "Netpbm", "product": "Netpbm", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "11.16.00"}], "collectionURL": "https://sourceforge.net/p/netpbm/code/", "defaultStatus": "unaffected"}], "datePublic": "2026-10-17T18:49:38.000Z", "references": [{"url": "https://hackmd.io/@haindpwn/netpbm-sunraster-rle-oob-write-palette-oob-read", "tags": ["third-party-advisory"]}, {"url": "https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rasttopnm.c", "tags": ["technical-description"]}, {"url": "https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rast.c", "tags": ["technical-description"]}, {"url": "https://netpbm.sourceforge.net/", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/netpbm-through-11.16.00-heap-out-of-bounds-read-via-rasttopnm-colormap", "name": "VulnCheck Advisory: Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "11.16.00"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-19T13:55:22.723Z"}}}, "cveMetadata": {"cveId": "CVE-2026-112276", "state": "PUBLISHED", "dateUpdated": "2026-10-19T14:13:40.705Z", "dateReserved": "2026-10-19T13:25:29.280Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-19T13:55:22.723Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://sourceforge.net/p/netpbm/code/", "defaultStatus": "unaffected", "product": "Netpbm", "repo": "https://sourceforge.net/p/netpbm/code/", "vendor": "Netpbm", "versions": [{"lessThanOrEqual": "11.16.00", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program."}], "id": "CVE-2026-112276", "lastModified": "2026-10-19T21:14:14.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112276", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-19T14:13:20.015700Z", "version": "2.0.3"}}]}, "published": "2026-10-19T14:17:05.520", "references": [{"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@haindpwn/netpbm-sunraster-rle-oob-write-palette-oob-read"}, {"source": "disclosure@vulncheck.com", "url": "https://netpbm.sourceforge.net/"}, {"source": "disclosure@vulncheck.com", "url": "https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rast.c"}, {"source": "disclosure@vulncheck.com", "url": "https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rasttopnm.c"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/netpbm-through-11.16.00-heap-out-of-bounds-read-via-rasttopnm-colormap"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://hackmd.io/@haindpwn/cve-2026-112275-112276-netpbm-sunraster-rle-oob-write-palette-oob-read"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "netpbm: netpbm: Denial of Service via out-of-bounds read in rasttopnm", "id": "2555605", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555605"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the rasttopnm utility of Netpbm. An attacker could exploit this by enticing a user to convert a specially crafted Sun rasterfile image with a truncated color palette, triggering an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) by crashing the application or allow unauthorized information disclosure by exposing adjacent memory contents in the generated output."], "name": "CVE-2026-112276", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "netpbm", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "netpbm", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "netpbm", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "netpbm", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "netpbm", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-19T13:55:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-112276\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112276\nhttps://hackmd.io/@haindpwn/netpbm-sunraster-rle-oob-write-palette-oob-read\nhttps://netpbm.sourceforge.net/\nhttps://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rast.c\nhttps://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rasttopnm.c\nhttps://www.vulncheck.com/advisories/netpbm-through-11.16.00-heap-out-of-bounds-read-via-rasttopnm-colormap"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,11.16.00]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Netpbm", "source": "cna", "vendor": "Netpbm"}, "product": "netpbm", "vendor": "netpbm"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "netpbm", "vendor": "netpbm_project"}], "created": "2026-10-19T16:15:07.007934+00:00", "updated": "2026-10-19T19:00:04.676546+00:00", "vendors": ["netpbm", "netpbm$PRODUCT$netpbm", "netpbm_project", "netpbm_project$PRODUCT$netpbm"]}