CVE-2026-111138

MediumCVSS 5.5

Published: 15/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. An attacker can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.

Risk Assessment

An attacker can crash applications processing untrusted BMP images (denial of service) or potentially leak memory data. The risk affects browsers and programs decoding BMP files.

Recommendation

Update libnsbmp to a patched version and avoid decoding untrusted BMP files until the fix is applied. Consider restricting RLE image processing in critical applications.

Other vulnerabilities in libnsbmp

CVE-2026-111139Medium
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows reading one byte past the image buffer by supplying crafted ICO files. An attacker can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmp_decode().

Original NVD description (English source)

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS