NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecoderle8() and bmpdecoderle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmpdecode().

NetSurf 3.11 is vulnerable to Use After Free in domnodesettextcontent function.

An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the domnodenormalize function

An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a domevent structure.