A heap buffer overflow exists in the xpmtoppm conversion tool of Netpbm, triggered by a lack of validation on the characters-per-pixel field in the XPM header. When an attacker supplies an XPM file whose declared characters-per-pixel value exceeds three, the program writes past the fixed three‑byte array used for colorName hash entries. The overflow can cause a crash or, if exploited skillfully, execution of arbitrary code. The weakness is classified as CWE‑787.

The vulnerability affects Netpbm releases prior to 10.86.51, 11.02.30, and 11.15.08. Users running any of these versions on any platform that employs the xpmtoppm utility for processing XPM images are potentially impacted.

The CVSS score of 8.5 denotes high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers must supply a crafted XPM file to trigger the overflow, so exploitation requires either local access to the target system or a context where untrusted XPM files are processed (e.g., image viewer, editor, or web application).