Netpbm’s rasttopnm component can read beyond the bounds of a supplied colormap when processing Sun raster files that contain a short palette. The flaw allows an attacker to craft a raster file where the number of pixel bytes exceeds the declared colormap length, causing a heap out‑of‑bounds read that leaks up to 255 bytes of adjacent heap memory into the PNM output or crashes the program. The vulnerability is mapped to CWE‑125 and can result in the disclosure of sensitive memory contents, but does not provide remote code execution capabilities.

The issue affects Netpbm version 11.16.00 and any earlier releases that include the rasttopnm conversion routine. The problem is present on all platforms supported by Netpbm that employ the Sun raster file format with colormaps.

The CVSS base score of 6.9 indicates moderate severity; there is no EPSS data and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a Sun raster file with a malformed colormap and an excessive number of pixel values; the attack vector is primarily local or remote file‑processing if the application processes user‑supplied raster data. Because the read is bounded to the memory surrounding the palette, the impact is limited to potential information leakage rather than arbitrary code execution.