CVE-2026-120432

Netpbm versions before 10.86.51 , 11.02.30 , and 11.15.08 are vulnerable to an integer overflow in the winicontopam component. An attacker can provide a crafted icon file with ICO/CUR dimensions exceeding 32767 , causing int16_t loop counters to wrap into negative row buffer indices. This leads t...