CVE-2026-111139 Details
Description
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmp_decode().
A vulnerability allowing out-of-bounds read has been identified in NetSurf's libnsbmp library, specifically in versions through 0.1.7. The issue arises in the BMP and ICO decoding components, where the ICO AND-mask decoder fails to properly validate the width of inner bitmaps. This flaw allows attackers to craft ICO files that exploit the decoder's handling of bitmap widths not aligned to multiples of 8, leading to a heap over-read. Such exploitation can cause applications to crash when they invoke the bmp_decode function.
Users are advised to update to the latest version of libnsbmp, where this vulnerability has been addressed. Instructions for downloading the updated version can be found on the NetSurf website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://download.netsurf-browser.org/libs/releases/libnsbmp-0.1.7-src.tar.gz | [email protected] | Broken LinkSource CodeVendor |
| https://github.com/netsurf-browser/libnsbmp | [email protected] | Source CodeVendor |
| https://github.com/netsurf-browser/libnsbmp/blob/ea063c9f46acb43e90208da14073332b505ef7e7/src/libnsbmp.c#L835-L873 | [email protected] | Source CodeVendor |
| https://hackmd.io/@haind-pwn/libnsbmp-rle-absolute-pad-and-ico-mask-oob-read | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/netsurf-libnsbmp-through-0.1.7-out-of-bounds-read-via-bmp-decode-mask | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NetSurf libnsbmp | <= 0.1.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |