Out-of-Bounds Read Vulnerability in NetSurf libnsbmp Affects Various Applications
CVE-2026-111138

6.8MEDIUM

Key Information:

Vendor

Netsurf

Status
Libnsbmp
Vendor
CVE Published:
15 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-111138?

The NetSurf libnsbmp library version 0.1.7 and earlier contains an out-of-bounds read vulnerability in the bmp_decode_rle8() and bmp_decode_rle4() functions. This issue arises from inadequate checks on absolute runs, particularly with the word-alignment pad byte being omitted. Attackers can exploit this by crafting RLE8 or RLE4 BMP files that end with an odd-length absolute run, leading to a one-byte heap over-read. This vulnerability can crash applications that attempt to decode untrusted images, raising significant concerns about software reliability and security in systems utilizing this library.

Affected Version(s)

libnsbmp 0 <= 0.1.7

References

https://hackmd.io/@haind-pwn/libnsbmp-rle-absolute-pad-an...
technical-descriptionexploit
https://github.com/netsurf-browser/libnsbmp/blob/ea063c9f...
technical-description
https://github.com/netsurf-browser/libnsbmp/blob/ea063c9f...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.