Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr_load_image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past md_image, causing memory corruption and crashes.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794238162 advisory.

  - Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam     that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a     crafted icon file with width or height above 32767, wrapping int16_t loop counters into negative row     buffer indices to cause crashes or potential code execution. (CVE-2026-120432)

  - Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile     run-length decoder pr_load_image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile     with tiny dimensions and a long run-length body to write controlled bytes past md_image, causing memory     corruption and crashes. (CVE-2026-112275)

  - Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in     jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a     crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the     undersized buffer, causing crashes or potentially code execution. (CVE-2026-120436)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1794237821 advisory.

  - Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam     that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a     crafted icon file with width or height above 32767, wrapping int16_t loop counters into negative row     buffer indices to cause crashes or potential code execution. (CVE-2026-120432)

  - Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile     run-length decoder pr_load_image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile     with tiny dimensions and a long run-length body to write controlled bytes past md_image, causing memory     corruption and crashes. (CVE-2026-112275)

  - Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in     jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a     crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the     undersized buffer, causing crashes or potentially code execution. (CVE-2026-120436)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794238162 advisory.

  - Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam     that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a     crafted icon file with width or height above 32767, wrapping int16_t loop counters into negative row     buffer indices to cause crashes or potential code execution. (CVE-2026-120432)

  - Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile     run-length decoder pr_load_image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile     with tiny dimensions and a long run-length body to write controlled bytes past md_image, causing memory     corruption and crashes. (CVE-2026-112275)

  - Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in     jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a     crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the     undersized buffer, causing crashes or potentially code execution. (CVE-2026-120436)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile     run-length decoder pr_load_image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile     with tiny dimensions and a long run-length body to write controlled bytes past md_image, causing memory     corruption and crashes. (CVE-2026-112275)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
377724	Rocky Linux 9.6 [TuxCare] Security Update: netpbm / netpbm-devel / netpbm-doc / netpbm-progs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1794238162)	Nessus	Rocky Linux Local Security Checks	Local	high
377720	AlmaLinux 9.2 [TuxCare] Security Update: netpbm / netpbm-devel / netpbm-doc / netpbm-progs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1794237821)	Nessus	Alma Linux Local Security Checks	Local	high
377719	AlmaLinux 9.6 [TuxCare] Security Update: netpbm / netpbm-devel / netpbm-doc / netpbm-progs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1794238162)	Nessus	Alma Linux Local Security Checks	Local	high
367360	Linux Distros Unpatched Vulnerability : CVE-2026-112275	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-112275

medium

Tenable Plugins

high

high

high

medium