CVE-2026-111138 in libnsbmp
Summary
by MITRE • 10/15/2026
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in NetSurf libnsbmp versions through 0.1.7 represents a critical memory safety flaw within the image processing subsystem, specifically affecting the handling of Run-Length Encoded (RLE) bitmap formats. The core technical deficiency lies in the implementation of the bmp_decode_rle8 and bmp_decode_rle4 functions, which are responsible for decompressing RLE-encoded data streams found in Windows Bitmap files. These functions utilize absolute run encoding to specify sequences of identical pixels or compressed byte runs. During the validation phase where bounds checking is performed to ensure that read operations remain within allocated memory limits, the code fails to account for word-alignment padding bytes. In many bitmap formats and internal processing structures, data must be aligned to specific word boundaries, often resulting in one-byte padding at the end of certain rows or chunks if their length is odd. The vulnerability arises because the absolute-run bound checks do not include this pad byte in their calculation, leading to a scenario where the decoder attempts to read beyond the intended buffer boundary by exactly one byte when processing an RLE8 or RLE4 BMP file that ends on an odd-length absolute run.
This specific logic error results in a heap-based out-of-bounds read vulnerability. When an attacker supplies a crafted malicious image file designed with these precise characteristics, the decoder will execute a memory access operation that exceeds the allocated buffer size by one byte. While this is technically classified as an over-read rather than an overwrite, it still poses significant security risks depending on what data resides in the adjacent memory location and how the application handles the retrieved value. In many cases, particularly within web browsers or image viewers like NetSurf, such a violation triggers immediate termination of the process to prevent further corruption or exploitation attempts. This manifests as a denial-of-service condition where any user opening the malicious file will experience an application crash. The impact is primarily localized to availability and stability for end-users interacting with untrusted content, although in more complex execution environments, reading adjacent memory could potentially leak sensitive information if that data contains cryptographic keys, session tokens, or other private state variables.
From a classification perspective, this vulnerability aligns closely with CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads past the end of a buffer. It also relates to CWE-682 regarding Incorrect Calculation, as the root cause is an arithmetic error in calculating valid memory boundaries during decompression. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates techniques associated with Initial Exploitation and Defense Evasion through Denial of Service (T1499). While primarily a stability issue due to the one-byte nature of the over-read, it demonstrates how improper input validation in legacy or specialized libraries can lead to predictable crashes that disrupt service availability. The vulnerability underscores the importance of rigorous bounds checking that accounts for all structural requirements of file formats, including alignment padding which is often overlooked during initial development phases focused on functional correctness rather than security hardening.
Mitigation strategies must focus on immediate patching and defensive coding practices. For users of NetSurf libnsbmp, upgrading to a version greater than 0.1.7 is the primary remediation step as this issue has been addressed in subsequent releases by correcting the bounds calculation logic to include word-alignment padding bytes. Developers integrating or maintaining similar image processing libraries should conduct thorough code audits focusing on all decompression routines that handle variable-length data streams, ensuring that boundary checks explicitly account for alignment requirements and padding bytes inherent to the file format specification. Additionally, implementing runtime memory protection mechanisms such as Address Sanitizer during development can help detect these types of off-by-one errors before they reach production environments. For organizations deploying NetSurf in public-facing services, it is advisable to implement strict input validation at the entry point to reject malformed bitmap files that exhibit suspicious length characteristics indicative of this exploit vector, thereby reducing the attack surface even if patching cannot be applied immediately.