Debian Linux Security Advisory 2026-1 - Marc Schoenefeld discovered a stack-based buffer overflow in the XPM reader implementation in netpbm-free, a suite of image manipulation utilities. An attacker could cause a denial of service (application crash) or possibly execute arbitrary code via an XPM image file that contains a crafted header field associated with a large color index value.
14051f709ce6403d1a744675caa6e472b5796bd620bcb7a4a8c075c290f734fc