CVE-2026-120434
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly() fun
CVSS
7.8
Alto
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 2 nov 2026 · Última mod.: 2 nov 2026 · CWE-121
Sin historial EPSS suficiente todavía.
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly() function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack array to crash the converter or potentially execute code.
- sourceforge.nethttps://sourceforge.net/p/netpbm/code/5331/
- svn.code.sf.nethttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5330/trunk/converter/ppm/picttoppm.c
- svn.code.sf.nethttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY
- svn.code.sf.nethttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY
- svn.code.sf.nethttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY
- www.vulncheck.comhttps://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-overflow-via-scanpoly
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1204337.8 ALT—
———Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.5hCVE-2026-1203367.3 ALT—
——0A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDll_925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.5hCVE-2026-205904.4 MED—
——0In display, there is a possible system crash due to a logic error. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11410704; Issue ID: MSV-9574.4hCVE-2026-12028310.0 CRÍ—
——0A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.5hCVE-2026-12028110.0 CRÍ—
——0A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.5hCVE-2026-1202525.5 MED3.1%
——1imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack arrays and crashing the calling process.2d