Linux Distros Unpatched Vulnerability : CVE-2026-111138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecoderle8 and bmpdecoderle4 because absolute-run bound checks omit the...

Linux Distros Unpatched Vulnerability : CVE-2026-111139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask that allows attackers to read one byte past the image buffer by...

UBUNTU-CVE-2026-111139

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can...

CVE-2026-111139

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can...

CVE-2026-111138

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecoderle8 and bmpdecoderle4 because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-rea...

CVE-2026-111139

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can...

CVE-2026-111139

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can...

EUVD-2026-102266

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can...

CVE-2026-111139

The NetSurf libnsbmp library (versions through 0.1.7 ) is vulnerable to an out-of-bounds read in the bmp_decode_mask() function. By providing a crafted ICO file where the inner bitmap width is not a multiple of 8, an attacker can trigger a heap over-read that reads one byte past the image buffer....

CVE-2026-111138 NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read in RLE8 and RLE4 Decoders

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecoderle8 and bmpdecoderle4 because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-rea...

CVE-2026-111138 NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read in RLE8 and RLE4 Decoders

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecoderle8 and bmpdecoderle4 because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-rea...

CVE-2026-111138

The NetSurf libnsbmp library, versions through 0.1.7 , is vulnerable to an out-of-bounds read within the bmp_decode_rle8() and bmp_decode_rle4() functions. The root cause is that absolute-run bound checks fail to account for the word-alignment pad byte . An attacker providing a crafted RLE8 or RL...

EUVD-2026-102265

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecoderle8 and bmpdecoderle4 because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-rea...

CVE-2026-111139 NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can...

CVE-2026-111139 NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can...

CVE-2026-111138: Out-of-bounds Read

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecoderle8 and bmpdecoderle4 because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-rea...

PT-2026-115144

Name of the Vulnerable Software and Affected Versions NetSurf libnsbmp versions prior to 0.1.8 Description An out-of-bounds read exists in the bmp decode rle8 and bmp decode rle4 functions. This occurs because absolute-run bound checks omit the word-alignment pad byte. A remote attacker can provi...

PT-2026-115145

Name of the Vulnerable Software and Affected Versions libnsbmp versions prior to 0.1.8 Description An out-of-bounds read exists in the bmp decode mask function. An attacker can trigger a heap over-read, which may crash applications calling bmp decode, by providing a specially crafted ICO file whe...

CVE-2026-111139: Out-of-bounds Read

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can...

CVE-2025-29699

NetSurf 3.11 is vulnerable to Use After Free in domnodesettextcontent function. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread...