The vulnerability is a stack-based buffer overflow within the scanPoly() function of the picttoppm converter. When processing a PICT file, polygon edges that generate more than 5,000 points overflow the coord stack array, which can lead to a crash or, if an attacker can control the execution path, arbitrary code execution. This flaw is categorized under CWE‑121 and poses a high risk to confidentiality, integrity, and availability of systems that run the vulnerable version.

Affected by this flaw are all versions of the Netpbm project before 10.86.51, before 11.02.30 in the 11.x releases, and before 11.15.08. The standard build of Netpbm includes picttoppm, so any installation relying on those versions is at risk.

The CVSS score for this flaw is 8.5, indicating high severity. The EPSS score is not provided, so exploitation probability remains unclear, and the vulnerability is not listed in CISA's KEV catalog, implying it has not yet been widely exploited. The attack vector typically involves supplying a crafted PICT file to picttoppm; if the program runs with elevated privileges, the overflow could be leveraged to execute arbitrary code, giving the attacker full control over the affected system.