CVE-2026-111138: NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read in RLE8 and RLE4 Decoders
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecoderle8() and bmpdecoderle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using NetSurf libnsbmp through version 0.1.7 to decode untrusted RLE8 or RLE4 BMP images are exposed. The reported impact is a crash during image decoding.
What must an attacker provide to trigger the vulnerability?
An attacker must cause the application to decode a crafted RLE8 or RLE4 BMP file. The file uses an odd-length absolute run so that the decoder mishandles the required word-alignment pad byte.
Is user interaction required?
Yes. The supplied vector indicates user interaction is required, consistent with an application decoding an attacker-supplied image.
What is the impact of successful exploitation?
Successful exploitation causes a one-byte heap out-of-bounds read and can crash the decoding application. The supplied assessment lists no confidentiality or integrity impact and an availability impact.