Netpbm contains an integer overflow in its winicontopam converter that processes ICO/CUR icon files. Attackers can supply a crafted icon with width or height values above 32767, causing int16_t counters to wrap and produce negative row buffer indices. The resulting corruption of heap memory can crash the application or potentially allow arbitrary code execution.

Vendors affected include Netpbm. The vulnerable releases are Netpbm 10.86.50 and earlier, 11.02.29 and earlier, and 11.15.07 and earlier. Any installation of Netpbm before 10.86.51, 11.02.30, and 11.15.08 is susceptible.

The vulnerability scores a CVSS 8.5, indicating high severity, and is not yet listed in CISA’s KEV catalog. The EPSS score is unavailable, but the high CVSS suggests that exploitation is considered probable if the conditions are met. The likely attack vector is local or remote delivery of a malicious ICO/CUR file to a program that uses Netpbm’s winicontopam function; the attacker needs ability to influence the icon file that is processed. Because the crash or code execution occurs during processing, the impact is confined to the process that loads the icon, but if that process has elevated privileges the damage can be severe.