EUVD-2026-102265Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious RLE8/RLE4 BMP with odd-length absolute run
-
DeliveryDeliver image to victim application
-
ExploitApplication decodes via libnsbmp bmp_decode_rle8/rle4
-
ExecutionOne-byte heap out-of-bounds read
-
ImpactProcess crash (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an application linking libnsbmp 0.1.7 or earlier to decode a crafted BMP that uses RLE8 or RLE4 compression and ends on an odd-length absolute run, so that the missing word-alignment pad byte defeats the absolute-run bound check in bmp_decode_rle8()/bmp_decode_rle4(). Limiting factors: exploitation needs user interaction to load/decode the attacker's image (CVSS UI:P), there is no authentication requirement (PR:N), and the outcome is strictly a one-byte heap over-read causing a crash - no code execution, memory corruption, or confidentiality impact. Only RLE-compressed BMP paths are affected; uncompressed or even-length absolute-run images do not trigger the flaw. |
| Impact | This is a moderate, bounded issue rather than a top-tier priority. The signals are internally consistent on IMPACT but conflict on VECTOR. The vendor CVSS 4.0 (6.8, MEDIUM) scores only availability (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), matching the description of a one-byte heap over-read that merely crashes the decoder - i.e. a denial-of-service, not code execution or data theft. Note the conflict: the 'Information Disclosure' tag and CWE-125 (out-of-bounds read) imply data exposure, but the description and CVSS explicitly describe a crash with VC:N, so treat this as a DoS, not an info-leak. A public exploit/write-up exists and the report comes from VulnCheck (a credible source), but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation. The vendor rated the vector AV:L (local), yet libnsbmp's primary consumer is the NetSurf web browser, where malicious BMPs arrive over the network - so real-world delivery may be remote (AV:N) with user interaction, which I reflect in my independent assessment below; verify intended deployment with the vendor. Net: low-to-moderate real-world risk, gated by a niche affected library and a crash-only outcome. |
| Exploit ScenarioDerived | An attacker crafts a BMP image using RLE8 or RLE4 compression that terminates on an odd-length absolute run, omitting the word-alignment pad byte, and delivers it via a web page or file to a victim whose application uses libnsbmp (for example the NetSurf browser). When the victim's application decodes the image, the flawed bound check triggers a one-byte heap over-read that crashes the process. A public proof-of-concept write-up already exists; the local attack vector and low complexity mean a working trigger file is trivial to reproduce, though user interaction (loading the image) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Decoding a crafted RLE8- or RLE4-compressed BMP image with NetSurf's libnsbmp 0.1.7 or earlier can drive a one-byte heap over-read in bmp_decode_rle8() or bmp_decode_rle4(), crashing the consuming application. The trigger is narrow: the image must use RLE compression and end on an odd-length absolute run, so the word-alignment pad byte that the decoder forgets to count defeats its absolute-run bound check. Publicly available exploit code exists (a technical write-up with a reproducer is linked in the advisory), and exploitation is unauthenticated but requires a user or process to load and decode the attacker's image; impact is bounded to denial of service via crash, with no code execution, memory corruption, or confidentiality impact, making this a moderate, bounded issue rather than a top-tier priority.
RemediationAI
No vendor-released patch has been identified at time of analysis; libnsbmp 0.1.7 is the newest release referenced in the advisory data, and the linked GitHub URLs point at the vulnerable source lines rather than at a fix commit or tagged release. Track the upstream repository at github.com/netsurf-browser/libnsbmp and the VulnCheck advisory at vulncheck.com/advisories/netsurf-libnsbmp-through-0.1.7-out-of-bounds-read-in-rle8-and-rle4-decoders for the corrected version, and apply it as soon as it is published; if you vendor the library, prefer adopting an upstream fix commit once one is announced rather than carrying a local patch indefinitely. Until a fix ships, the highest-value compensating control is to stop feeding untrusted RLE-compressed BMP data to the decoder: reject or strip BMP files whose headers specify BI_RLE8 or BI_RLE4 compression at every trust boundary that handles attacker-controlled images (browser content filters, mail gateways, upload validation, thumbnail services), accepting the trade-off that legacy RLE BMPs will no longer render. Where full BMP support is required, pre-validate images with an independent, memory-safe decoder such as libbmp or a Rust/Go image pipeline and pass only re-encoded uncompressed output to libnsbmp, which costs an extra decode pass but eliminates the RLE path entirely. As defense in depth, run image decoding in a separate, low-privilege worker process with a tight memory limit and automatic restart so that the one-byte over-read results in a contained worker crash instead of taking down the parent application, and enable crash reporting on the decode path to detect exploitation attempts. Note that the flaw is only reachable through the RLE8/RLE4 code paths, so no mitigation is needed for deployments that already restrict libnsbmp to uncompressed BMP input.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libnsbmp is a small standalone C library maintained by the NetSurf browser project for decoding BMP and ICO images; it is linked by the NetSurf browser and by other embedders that need lightweight bitmap parsing. The flaw lives in the RLE decoders, which handle the two run-length-encoded BMP variants: RLE8 (8 bits per pixel, run-length encoded) and RLE4 (4 bits per pixel, packed two pixels per byte). Both formats use two modes: encoded mode, where a byte pair gives a pixel count and a pixel value, and absolute mode, where a zero marker is followed by a byte count and that many literal pixel bytes. Per the BMP specification, an absolute-mode run must be followed by a pad byte if the run length is odd, so that the decoder resumes on a word boundary. The implementation in libnsbmp validates the absolute run against the remaining buffer size but omits that pad byte from the check, so a crafted image whose final absolute run has an odd length makes the decoder read one byte past the end of the heap allocation. The root cause is CWE-125, Out-of-bounds Read, in the bounds arithmetic of bmp_decode_rle8() and bmp_decode_rle4() (see the linked source lines around libnsbmp.c:942-982 and 1096-1147 at commit ea063c9f46acb43e90208da14073332b505ef7e7). The only affected configuration is the RLE-compressed BMP path; uncompressed BMP data and absolute runs of even length do not reach the faulty check. An attacker's practical gain is a read of at most one byte beyond the buffer, which typically results in a crash rather than disclosure of meaningful data.
Know when Netsurf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
AV:N because libnsbmp decodes untrusted images fetched remotely in the NetSurf browser; UI:R as the victim must load the image; crash yields A:H, no C/I impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
A heap out-of-bounds read in NetSurf libnsbmp through 0.1.7 can crash applications that call bmp_decode() when they proc
An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure.
NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function. Rated medium severity (CVSS 6.5), th
An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize function. Rated
Exploit-DB