CVE-2026-111139: Out-of-bounds Read in NetSurf libnsbmp

NetSurf libnsbmp versions up to 0.1.7 contain an out-of-bounds read vulnerability in the bmp_decode_mask() function. An attacker can supply a specially crafted ICO file whose inner bitmap width is not a multiple of 8, triggering a heap over-read of one byte past the image buffer. This vulnerability can cause applications using bmp_decode() to crash due to this memory access violation.

The vulnerability allows an attacker to cause a heap over-read by one byte, which can lead to application crashes. There is no indication from the data that this vulnerability allows code execution or information disclosure beyond the one-byte read. The CVSS 4.0 score of 6.8 reflects a medium severity impact with local attack vector and no privileges required but user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted ICO files with libnsbmp or implement input validation to reject ICO files with bitmap widths not divisible by 8.