CVE-2017-2581

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file...

4.5 MediumFix available

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

1.13%Unchanged since Apr 14, 2021

What each source reports

CVE List Score used 4.5

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution.

Record: CVE-2017-2581
CVSS 3.0: 4.5 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2017-11762 4.5

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution.

Record: EUVD-2017-11762
CVSS 3.0: 4.5 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gc68-cc38-mrhh 7.8

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file...

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution.

Record: GHSA-gc68-cc38-mrhh
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

NVD 4.5

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution.

Record: CVE-2017-2581
CVSS 3.0: 4.5 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-787
Updated: 2026-11-02

OSV 7.8

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution.

Record: CVE-2017-2581
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-2581 7.8

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution.

Record: DEBIAN-CVE-2017-2581
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2017-0058 No score

Updated netpbm packages fix security vulnerability

Version 10.73.07 fixes security vulnerabilities:

Out-of-bounds write in writeRasterPbm() (CVE-2017-2581)
Out-of-bounds read in expandCodeOntoStack() (CVE-2017-2579)
Out-of-bounds write of heap data in addPixelToRaster() (CVE-2017-2580)
Null pointer dereference in stringToUint (CVE-2017-2586)
Insufficient size check of memory allocation in createCanvas() (CVE-2017-2587)

Record: MGASA-2017-0058
Updated: 2026-11-02

OSVSUSE-SU-2017:1575-1 No score

Security update for netpbm

This update for netpbm fixes the following security issues:

CVE-2017-2581: An out-of-bounds write in writeRasterPbm() could lead to memory corruption and potential code execution. (bsc#1024287)

Record: SUSE-SU-2017:1575-1
Updated: 2026-11-02

OSVSUSE-SU-2017:1603-1 No score

Security update for netpbm

This update for netpbm fixes the following issues:

Security bugs:

CVE-2017-2586: A NULL pointer dereference in stringToUint function could lead to a denial of service (abort) problem when processing malformed images. [bsc#1024292]
CVE-2017-2581: A out-of-bounds write in writeRasterPbm() could be used by attackers to crash the decoder or potentially execute code. [bsc#1024287]
CVE-2017-2587: A insufficient size check of memory allocation in createCanvas() function could be used for a denial of service attack (memory exhaustion) [bsc#1024294]

Record: SUSE-SU-2017:1603-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`netpbm-free` Debian:12	before 2:10.97.00-1	2:10.97.00-1
`netpbm-free` Debian:13	before 2:10.97.00-1	2:10.97.00-1
`netpbm-free` Debian:14	before 2:10.97.00-1	2:10.97.00-1
`netpbm` Mageia:5 From an advisory covering 5 CVEs	before 10.73.07-1.mga5	10.73.07-1.mga5
`netpbm` SUSE:Linux Enterprise Software Development Kit 11 SP4	before 10.26.44-101.14.1	10.26.44-101.14.1
`netpbm` SUSE:Linux Enterprise Server 11 SP4	before 10.26.44-101.14.1	10.26.44-101.14.1
`netpbm` SUSE:Linux Enterprise Server for SAP Applications 11 SP4	before 10.26.44-101.14.1	10.26.44-101.14.1
`netpbm` SUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 3 CVEs	before 10.66.3-7.1	10.66.3-7.1
`netpbm` SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 From an advisory covering 3 CVEs	before 10.66.3-7.1	10.66.3-7.1
`netpbm` SUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 3 CVEs	before 10.66.3-7.1	10.66.3-7.1
`netpbm` SUSE:Linux Enterprise Server 12 SP2 From an advisory covering 3 CVEs	before 10.66.3-7.1	10.66.3-7.1
`netpbm` SUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 3 CVEs	before 10.66.3-7.1	10.66.3-7.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-2581 is a medium vulnerability (CVSS 4.5) in Netpbm, published February 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in netpbm-free 2:10.97.00-1.

References

Show 10 moreShow less