← WebKit Silent-Fix Report — 2026-W34
e269e1967d8d2dd0d4b1ba8bedd38900a46b6102 Out-of-bounds read in BMP RLE24 absolute-mode decoding
severity medium
class OOB
confidence 0.55
WebCore BMP decoder
Primitive: Out-of-bounds read in BMP RLE24 absolute-mode decoding
Triage note: processNonRLEData computed endX from m_coord.x()+numPixels and indexed pixel bytes by absolute column, but an RLE absolute-mode run can start mid-row where m_decodedOffset points at the run start, causing reads past the buffer. Fix introduces startX and indexes relative to it, keeping reads within the checked paddedNumBytes.
Triage note: processNonRLEData computed endX from m_coord.x()+numPixels and indexed pixel bytes by absolute column, but an RLE absolute-mode run can start mid-row where m_decodedOffset points at the run start, causing reads past the buffer. Fix introduces startX and indexes relative to it, keeping reads within the checked paddedNumBytes.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…