Launchpad.net

CVE 2021-40985

A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to image_load_bmp.

See the CVE page on Mitre.org for more details.