CVE-2026-120437
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm convert
CVSS
6.1
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 2 nov 2026 · Última mod.: 2 nov 2026 · CWE-125
Sin historial EPSS suficiente todavía.
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values exceed the declared color map bounds to crash the converter or leak adjacent memory into the output image.
- sourceforge.nethttps://sourceforge.net/p/netpbm/code/5334/
- svn.code.sf.nethttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5333/trunk/converter/ppm/tgatoppm.c
- svn.code.sf.nethttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY
- svn.code.sf.nethttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY
- svn.code.sf.nethttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY
- www.vulncheck.comhttps://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-out-of-bounds-read-via-tgatoppm
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1204533.3 BAJ—
———The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.3hCVE-2026-111959——
———Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.
Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.
Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.5hCVE-2026-685905.3 MED—
——0In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01387180; Issue ID: MSV-5152.3hCVE-2026-205985.3 MED—
——0In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01755742; Issue ID: MSV-8896.3hCVE-2026-205975.3 MED—
——0In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758223; Issue ID: MSV-8909.3hCVE-2026-205965.3 MED—
——0In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758225; Issue ID: MSV-8910.3h