Out-of-Bounds Read in NetSurf libnsbmp

Executive Summary

This vulnerability is an out-of-bounds read in NetSurf libnsbmp through version 0.1.7. It occurs in the RLE8 and RLE4 decoders when processing crafted BMP files. The issue happens because bound checks for absolute runs do not account for word-alignment pad bytes, allowing a one-byte heap over-read when an odd-length absolute run ends at the file boundary.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems using libnsbmp 0.1.7 or earlier for crashes when processing BMP/ICO files. Use tools like AddressSanitizer to identify out-of-bounds reads during image decoding. Monitor logs for application crashes linked to BMP/ICO file parsing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications using libnsbmp to crash when processing untrusted BMP or ICO files. The impact ranges from silent memory over-reads to application crashes, depending on the memory allocator. It does not appear to allow arbitrary code execution or information disclosure based on available analysis.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update libnsbmp to a patched version beyond 0.1.7. If updating is not possible, restrict processing of untrusted BMP/ICO files or disable RLE decoding features. Apply network-level controls to block suspicious image files.

Useful 0 Not Useful 0