CVE-2026-120432
Description
A flaw was found in Netpbm. An integer overflow in the winicontopam utility occurs when processing icon or cursor files with excessively large dimensions. By tricking a user or system into processing a specially crafted file, an attacker could corrupt memory, potentially leading to arbitrary code execution or a Denial of Service (DoS) crash.
Statement
This vulnerability is rated as an Important severity issue for Red Hat Enterprise Linux because successful exploitation allows an attacker to achieve arbitrary code execution or cause an application crash with the privileges of the executing process. The affected winicontopam binary is a short-lived command-line conversion utility rather than a persistent network daemon, meaning exposure is limited to systems where users or automated ingestion pipelines process untrusted Windows icon or cursor files. Standard server deployments that do not handle untrusted graphical assets or that omit the optional command-line utilities package remain unaffected during typical operations.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce image dimension bounds checking or block untrusted icon and cursor parsing in winicontopam: upgrade to Netpbm 10.86.51, 11.02.30, and 11.15.08 (or the fixed Netpbm builds), which correct integer arithmetic calculations in winicontopam.c to prevent overflow and wrapping when handling large image dimensions, closing all 2 injection vectors (crafted ICO file with oversized dimensions, crafted CUR file with oversized dimensions). Until patched, this is only a concern on Linux systems and ingestion pipelines invoking winicontopam on untrusted files — Deployments not handling untrusted graphical assets or omitting the utility are unaffected — so Prevent untrusted ICO or CUR files from reaching winicontopam, or pre-validate icon dimensions to ensure neither width nor height exceeds 32767. As a compensating measure, Run SELinux in enforcing mode to constrain unauthorized actions by the winicontopam process, Apply SELinux confined user mappings to restrict execution privileges for accounts running winicontopam, Use Landlock LSM to sandbox filesystem access during conversion processes, Isolate file ingestion pipelines running winicontopam within mount, PID, and network namespaces, Deploy EDR agents to detect post-exploitation behaviors such as unexpected child process execution, and Use Falco or eBPF runtime tooling to monitor anomalous system calls triggered by winicontopam. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Availability
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart
Out of bounds memory access will very likely result in the corruption of relevant memory, and perhaps instructions, possibly leading to a crash.
Integrity,Confidentiality,Availability,Access Control,Other
Technical Impact: Execute Unauthorized Code or Commands; Modify Memory; Bypass Protection Mechanism; Other
If the corrupted memory can be effectively controlled, it may be possible to execute arbitrary code. If the corrupted memory is data rather than instructions, the system will continue to function with improper changes, possibly in violation of an implicit or explicit policy. The consequences would only be limited by how the affected data is used, such as an adjacent memory location that is used to specify whether the user has special privileges.
Access Control,Other
Technical Impact: Bypass Protection Mechanism; Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
