NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecoderle8() and bmpdecoderle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmpdecode().