The vulnerability resides in the bmp_decode_rle8() and bmp_decode_rle4() functions of NetSurf libnsbmp up to version 0.1.7. The bug arises because absolute‑run bound checks omit the word‑alignment pad byte, allowing an attacker supplied BMP file with an odd‑length absolute run to trigger a one‑byte heap over‑read. This out‑of‑bounds read can corrupt memory, lead to a crash, or potentially enable further exploitation if an attacker can control the surrounding memory.

Affected systems include any deployment of the NetSurf Linux browser distribution or applications that embed the libnsbmp library version 0.1.7 or earlier. The CNA lists the vendor as NetSurf and the product as libnsbmp; the fix is available in the 0.1.8 release. Systems that rely on older releases remain vulnerable until the library is updated.

The CVSS score of 6.8 suggests a moderate severity with limited impact on confidentiality or integrity, but the risk is elevated by the fact that any application that decodes untrusted BMP images can be brought down. The EPSS score of less than 1% indicates that exploitation is currently rare, and the vulnerability is not present in the CISA KEV catalog, reducing the likelihood of organized attacks. However, the crash effect may be sufficient for denial‑of‑service attacks or as a foothold if combined with other weaknesses. The most probable attack vector is the injection of a crafted BMP file to a vulnerable application that processes images from untrusted sources.