Libnsbmp
Monthly
A heap out-of-bounds read in NetSurf libnsbmp through 0.1.7 can crash applications that call bmp_decode() when they process a crafted ICO file whose inner bitmap width is not a multiple of 8. Publicly available exploit code exists, and exploitation requires user interaction to open or process the malicious file. The flaw is a one-byte over-read (CWE-125) with no privileges required (PR:N) but a local attack vector; the impact is limited to a possible application crash, with no confirmed data disclosure or code execution.
Decoding a crafted RLE8- or RLE4-compressed BMP image with NetSurf's libnsbmp 0.1.7 or earlier can drive a one-byte heap over-read in bmp_decode_rle8() or bmp_decode_rle4(), crashing the consuming application. The trigger is narrow: the image must use RLE compression and end on an odd-length absolute run, so the word-alignment pad byte that the decoder forgets to count defeats its absolute-run bound check. Publicly available exploit code exists (a technical write-up with a reproducer is linked in the advisory), and exploitation is unauthenticated but requires a user or process to load and decode the attacker's image; impact is bounded to denial of service via crash, with no code execution, memory corruption, or confidentiality impact, making this a moderate, bounded issue rather than a top-tier priority.
A heap out-of-bounds read in NetSurf libnsbmp through 0.1.7 can crash applications that call bmp_decode() when they process a crafted ICO file whose inner bitmap width is not a multiple of 8. Publicly available exploit code exists, and exploitation requires user interaction to open or process the malicious file. The flaw is a one-byte over-read (CWE-125) with no privileges required (PR:N) but a local attack vector; the impact is limited to a possible application crash, with no confirmed data disclosure or code execution.
Decoding a crafted RLE8- or RLE4-compressed BMP image with NetSurf's libnsbmp 0.1.7 or earlier can drive a one-byte heap over-read in bmp_decode_rle8() or bmp_decode_rle4(), crashing the consuming application. The trigger is narrow: the image must use RLE compression and end on an odd-length absolute run, so the word-alignment pad byte that the decoder forgets to count defeats its absolute-run bound check. Publicly available exploit code exists (a technical write-up with a reproducer is linked in the advisory), and exploitation is unauthenticated but requires a user or process to load and decode the attacker's image; impact is bounded to denial of service via crash, with no code execution, memory corruption, or confidentiality impact, making this a moderate, bounded issue rather than a top-tier priority.