Integer overflow in the readpgm function in pnm.c for GOCR 0.40 when using the netpbm library allows remote attackers to execute arbitrary code via a PNM file with large width and height values which leads to a heap-based buffer overflow.