NetSurf libnsbmp in versions up to 0.1.7 contains an out-of-bounds read in the bmp_decode_mask function, which can read one byte beyond the allocated buffer when decoding an ICO image whose inner bitmap width is not a multiple of 8. This heap over-read exposes arbitrary sensitive data that resides adjacent to the buffer and can also lead to a crash. The weakness is classified as CWE‑125. The likely attack vector is a crafted ICO file supplied to an application that uses libnsbmp for image decoding. This could happen when a web browser, image viewer, or other software processes an untrusted image file. While the CVE does not claim remote exploitation, an attacker who can influence the image input can use the over‑read to read confidential memory or cause denial of service by crashing the decoding routine.

The vulnerable component is NetSurf libnsbmp from the NetSurf project. All versions up to and including 0.1.7 are affected. The CVE references the library source code and the CPE identifier cpe:2.3:a:netsurf-browser:libnsbmp:*:*:*:*:*:*:*:* applies to the affected versions.

The CVSS score of 6.8 indicates a moderate severity. The EPSS score of <1% shows a very low estimated likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The exploit requires supplying a crafted ICO file to the target application; no network-based attack vector is described, so exploitation is likely limited to local or application-level attacks or remote files if the browser accepts untrusted images.