CVE-2026-111139 — NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer by supplying crafte…
Published: 2026-10-15 · CVSS: 6.8 · CVSS 4.0
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmp_decode().
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7