NetSurf libnsbmp EUVD-2026-102266

Requires an attacker-supplied ICO file whose inner bitmap width is not a multiple of 8, processed by an application that calls libnsbmp's bmp_decode() (library versions through 0.1.7); the malformed mask triggers the one-byte heap over-read in bmp_decode_mask(). Exploitation is LIMITED by: a local attack vector (the file must reach the victim's decoder - there is no network-facing default), required user interaction to open/process the file (UI:P), and an impact ceiling of an application crash only (no code execution, write, or confirmed data disclosure). No special product configuration is needed beyond use of the vulnerable library to decode ICO input.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) frames this as a low-complexity, no-privilege flaw whose only impact is availability - there is no confidentiality (VC:N) or integrity (VI:N) impact, consistent with CWE-125 (out-of-bounds READ) and the description, which describes a single-byte heap over-read that merely crashes the calling application. Critically, the attack vector is LOCAL (AV:L) with passive user interaction required (UI:P): an attacker cannot reach the parser remotely but must get a victim to open/process a crafted ICO file. Publicly available exploit code exists (VulnCheck advisory plus a hackmd technical write-up), but this is NOT CISA KEV-listed and no EPSS score was provided, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals. The input rates availability as VA:H, which seems aggressive for a one-byte over-read producing a recoverable single-process crash; this is better characterized as a transient denial-of-service of one application instance rather than a high-impact outage. Net: real but low-priority - a POC-backed local DoS in a niche library, not a critical remotely-exploitable issue despite the 6.8 'medium' score.

An attacker crafts a malicious ICO file containing an inner bitmap whose width is not a multiple of 8 and delivers it to a victim who opens it in an application (e.g., the NetSurf browser or any tool) that uses libnsbmp's bmp_decode(). When bmp_decode_mask() processes the mask, it reads one byte past the heap image buffer, crashing the application. A public proof-of-concept and technical write-up for this over-read already exist.