Netpbm contains a heap-based buffer overflow in the sgitopnm utility’s readChannels() routine. The flaw is triggered when an attacker supplies an SGI image whose RLE offset table exceeds the expected length, allowing data to be written past the allocated heap buffer. This can cause a crash or, in a worst‑case scenario, arbitrary code execution within the context of the process that processes the image.

Netpbm from the Netpbm project is affected in all releases before 10.86.51, before 11.02.29 in the 11.x series, and before 11.15.07 in the 11.03 branch. No specific vendor builds other than the official Netpbm distribution are listed.

The CVSS score of 8.5 classifies this vulnerability as high severity, and the EPSS score is not available, suggesting limited current exploitation data. The flaw is in the heap and occurs during processing of SGI images, so an attacker can trigger it by providing a crafted SGI file through any channel that invokes sgitopnm—such as uploading a file, transferring data over a network, or dropping a file in a shared folder. The vulnerability is not listed in CISA’s KEV catalog, but its high impact warrants immediate remediations.