An out‑of‑bounds read occurs in Netpbm’s tgatoppm converter when its get_pixel() function uses pixel values directly as color‑map indices without bounds checking. A malicious Targa file with pixel values that exceed the declared color‑map limits can trigger the converter to read memory beyond the intended buffer, potentially causing a crash or leaking adjacent memory contents into the output image. This flaw is identified as CWE‑125.

The vulnerability affects Netpbm image tools prior to versions 10.86.51, 11.02.30, and 11.15.08. Users who run the tgatoppm converter on these legacy releases are at risk.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available, while the flaw is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a crafted Targa file to the vulnerable binary, which is a local or input‑based attack vector; if the converter processes untrusted files in a remote or elevated context, the risk increases.