CVE-2026-111139

MediumCVSS 5.5

Published: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows reading one byte past the image buffer by supplying crafted ICO files. An attacker can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmp_decode().

Risk Assessment

An attacker can crash applications processing untrusted images (denial of service) or potentially leak memory data. The risk affects browsers and programs decoding ICO/BMP files.

Recommendation

Update libnsbmp to a patched version and avoid decoding untrusted ICO/BMP files until the fix is applied. Monitor applications using libnsbmp for unexpected crashes.

Other vulnerabilities in libnsbmp

CVE-2026-111138Medium
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. An attacker can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.

Original NVD description (English source)

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmp_decode().

Vulnerability data from NVD (NIST) · CISA KEV · EPSS