CVE-2026-111138 Details
Description
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.
A vulnerability allowing out-of-bounds read has been identified in NetSurf's libnsbmp library, specifically in versions through 0.1.7. The issue arises in the RLE8 and RLE4 BMP decoders, where absolute-run bound checks fail to account for the word-alignment pad byte. This oversight allows attackers to craft BMP files with odd-length absolute runs, leading to a one-byte heap over-read. The vulnerability can cause applications to crash while decoding untrusted images.
To address this vulnerability, the libnsbmp library should be updated to version 0.1.7 or later, where the issue has been fixed. Users can download the latest version from the NetSurf download page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NetSurf libnsbmp | <= 0.1.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |