CVE-2026-111139

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp decode mask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmp decode().