Netpbm contains a heap out‑of‑bounds write in the rasttopnm Sun rasterfile run‑length decoder. A malicious rasterfile with very small dimensions and an excessively long run‑length body can cause the decoder to write controlled bytes beyond the allocated image buffer, corrupting heap memory and resulting in program crashes. The flaw is a classic OOB write (CWE-787) that can potentially enable an attacker to manipulate heap objects and impact application stability.

The vulnerability applies to Netpbm installations up to version 11.16.00 inclusive. The affected component is the rasttopnm conversion utility, defined in the Netpbm project’s converter/other/rast.c source files. Systems that rely on Netpbm for image conversion, especially those that process Sun raster files from untrusted sources, are at risk.

The CVSS score of 6.9 signals moderate severity. EPSS information is not provided and the issue is not listed in CISA’s KEV catalog, suggesting limited known exploitation. An attacker must supply a crafted raster file to the rasttopnm process, which may be feasible if the application accepts untrusted files. Exploitation would likely lead to crashes and, depending on the memory context, potentially to arbitrary code execution, but the primary impact remains denial of service.