CVE-2026-111139: NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmpdecode().
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications that use NetSurf libnsbmp through 0.1.7 and call bmp_decode() on attacker-controlled ICO files are exposed. The reported impact is a crash caused by a one-byte heap over-read.
What must an attacker provide to trigger the flaw?
An attacker must supply a crafted ICO file whose embedded bitmap width is not a multiple of 8. Exploitation also requires the application to process that file with bmp_decode().
Does exploitation require prior access or user interaction?
The supplied vector indicates local attack access, no privileges required, and user interaction required. The vulnerability data does not specify the particular user action or delivery path.