Out-of-bounds Read
CWE-125 · 761 records · 315 with a public proof-of-concept
Records the NVD classes as Out-of-bounds Read (CWE-125), highest CVSS first.
- CRITICAL 9.8CVE-2026-96639public PoC
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK da…
pillow
- CRITICAL 9.8CVE-2026-49868public PoC
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and I…
- CRITICAL 9.8CVE-2026-97805
Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- CRITICAL 9.8CVE-2026-103513public PoC
Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A crafted serialized CPC sketch passed to cpc_sketch::deserialize(), from either a byte buffer or a stream, can cause the decompressor to read …
- CRITICAL 9.8CVE-2026-71256public PoC
nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic / recv_read_device_identification_res in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to …
- CRITICAL 9.1CVE-2026-111959
Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds…
- CRITICAL 9.1CVE-2026-109395public PoC
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the def…
- CRITICAL 9.1CVE-2026-107373public PoC
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ arguments …
- CRITICAL 9.1CVE-2026-103635public PoC
Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking that the input was long enough.…
- CRITICAL 9.1CVE-2026-7826public PoC
A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password con…
- CRITICAL 9.1CVE-2026-86930
An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed i…
- HIGH 8.8CVE-2026-121208
Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.8CVE-2026-121184
Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- HIGH 8.8CVE-2026-86929
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to arbitrary code execution.
macos
- HIGH 8.8CVE-2026-113233
Out of bounds read in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · android
- HIGH 8.8CVE-2026-113095
Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.8CVE-2026-113006
Out of bounds read in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- HIGH 8.8CVE-2026-109588public PoC
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or w…
- HIGH 8.8CVE-2026-63626public PoC
Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6…
- HIGH 8.8CVE-2026-97755
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server · sharepoint server
- HIGH 8.8CVE-2026-88159
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-88115
Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-83797
Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-70254
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-70210
Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network.
- HIGH 8.8CVE-2026-105718
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-105595
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-105007
An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. To exploit the vulnerability, in a local attack scenario, an attacker could r…
- HIGH 8.8CVE-2026-102225
Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
- HIGH 8.6CVE-2026-76457
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally di…
- HIGH 8.6CVE-2026-102560
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap bu…
- HIGH 8.6CVE-2026-102559
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer ov…
- HIGH 8.6CVE-2026-102558
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame d…
- HIGH 8.6CVE-2026-102557
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation w…
- HIGH 8.6CVE-2026-102521public PoC
The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders' view, thus exposing adjacent process memory. This can be anything that is currently in t…
- HIGH 8.6CVE-2026-102360public PoC
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. `readUint8Array` never compares the wire-supplied lengt…
- HIGH 8.4CVE-2026-58844
In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- HIGH 8.3CVE-2026-121140
Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.3CVE-2026-121112
Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.3CVE-2026-121084
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.2CVE-2026-119610
A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflo…
- HIGH 8.2CVE-2026-92698public PoC
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_pa…
- HIGH 8.2CVE-2026-92695public PoC
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the live parse_packet() callback in src/pcap_plugin/pcap_collector.cpp is registered through pcap_loop and processes captured frames when pcap = on without checking packet…
- HIGH 8.2CVE-2026-92693public PoC
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without…
- HIGH 8.2CVE-2026-9535
A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.
- HIGH 8.2CVE-2026-93442
IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.
- HIGH 8.2CVE-2026-85369
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- HIGH 8.2CVE-2026-107837public PoC
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c can route an undersized packet into SFF frag…
- HIGH 8.2CVE-2026-14496
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
datapower gateway
- HIGH 8.2CVE-2026-77214public PoC
libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, s…
- HIGH 8.2CVE-2026-102555
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length …
- HIGH 8.2CVE-2026-84782public PoC
Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspende…
- HIGH 8.2CVE-2026-97059public PoC
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more fr…
- HIGH 8.1CVE-2026-125405public PoC
Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffe…
- HIGH 8.1CVE-2026-125403public PoC
Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS s…
- HIGH 8.1CVE-2026-125402public PoC
Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL inter…
- HIGH 8.1CVE-2026-119924public PoC
An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent p…
- HIGH 8.1CVE-2026-76077public PoC
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound…
- HIGH 8.1CVE-2026-96644public PoC
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeigh…
pillow · windows
- HIGH 8.1CVE-2026-83844
Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.
- HIGH 8.1CVE-2026-82334
IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causin…
guardium data protection
- HIGH 8.1CVE-2026-100387public PoC
pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled siz…
- HIGH 8.1CVE-2026-58004
Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers. This issue affects Trusted Firmware: through socfpga_v2.14.0.
- HIGH 7.9CVE-2026-62958public PoC
libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-head…
- HIGH 7.8CVE-2026-87041public PoC
The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated the results of K_SYSCALL_MEMORY() into its valid_sqe flag with &=. That macro returns nonzero on failure (it is built on K…
- HIGH 7.8CVE-2026-119722
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so fi…
blender
- HIGH 7.8CVE-2026-107900
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
- HIGH 7.8CVE-2026-107899
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
- HIGH 7.8CVE-2026-107898
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
- HIGH 7.8CVE-2026-107897
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
- HIGH 7.8CVE-2026-107896
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
- HIGH 7.8CVE-2026-103842
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the…
substance 3d stager
- HIGH 7.8CVE-2026-103841
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the…
substance 3d stager
- HIGH 7.8CVE-2026-103840
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the…
substance 3d stager
- HIGH 7.8CVE-2026-96928
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-96867
Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.
- HIGH 7.8CVE-2026-96862
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-96306
Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-96118
Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-88194
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-88189
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7.8CVE-2026-88188
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-88181
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7.8CVE-2026-88180
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7.8CVE-2026-88179
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-88177
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-88070
Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-85858
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85837
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
windows 11 24h2 · windows 11 25h2 · windows 11 26h1 · windows 11 26h2 · windows server 2025
- HIGH 7.8CVE-2026-85356
Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85338
Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7.8CVE-2026-83832
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83637
Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83567
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83508
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70247
Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally.
- HIGH 7.8CVE-2026-70228
Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-69959
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-69952
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-69867
Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-69471
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-105004
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-103553
Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-47592public PoC
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalati…
- HIGH 7.8CVE-2026-47545public PoC
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of pri…
- HIGH 7.8CVE-2026-47536public PoC
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privilege…
- HIGH 7.8CVE-2026-47535public PoC
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, inform…
- HIGH 7.8CVE-2026-47521public PoC
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privilege…
- HIGH 7.8CVE-2026-47520public PoC
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privilege…
- HIGH 7.8CVE-2026-47519public PoC
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privilege…
- HIGH 7.8CVE-2026-47513public PoC
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read from kernel heap memory. A successful exploit of this vulnerability might lead to code execution, denial of servic…
- HIGH 7.8CVE-2026-47512public PoC
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read leading to kernel information disclosure. A successful exploit of this vulnerability might lead to code execution,…
- HIGH 7.8CVE-2026-47499public PoC
NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a guest could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of p…
- HIGH 7.7CVE-2026-88081
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- HIGH 7.7CVE-2026-85888
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- HIGH 7.7CVE-2026-47576public PoC
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module through which an attacker might initiate an out-of-bounds read. Successful exploitation of this issue could lead to denial of service and information disclosure.
- HIGH 7.6CVE-2026-115484
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send…
- HIGH 7.5CVE-2026-109806
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request containing malformed image data, triggering an integer overflow that leads to…
- HIGH 7.5CVE-2026-123805public PoC
SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the …
- HIGH 7.5CVE-2026-92697public PoC
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls strlen() on an attacker-controlled interface-description field without bounding the scan to the field’s declared length. Although fields l…
- HIGH 7.5CVE-2026-116784public PoC
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared R…
- HIGH 7.5CVE-2026-116782public PoC
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to a…
- HIGH 7.5CVE-2026-116568public PoC
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inboun…
- HIGH 7.5CVE-2026-17493
IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
- HIGH 7.5CVE-2026-58924
The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the…
android
- HIGH 7.5CVE-2026-90869
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
- HIGH 7.5CVE-2026-104594public PoC
libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.
- HIGH 7.5CVE-2026-102486
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.
- HIGH 7.5CVE-2026-56386
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Caus…
- HIGH 7.5CVE-2026-46472
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.
- HIGH 7.5CVE-2026-102941public PoC
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destinat…
- HIGH 7.5CVE-2026-101290
A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-service conditio…
- HIGH 7.5CVE-2026-73261public PoC
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a N…
- HIGH 7.5CVE-2026-73260public PoC
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_de…
- HIGH 7.5CVE-2026-73252public PoC
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentTy…
- HIGH 7.5CVE-2026-96866
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
- HIGH 7.5CVE-2026-96861
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
- HIGH 7.5CVE-2026-96246
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.5CVE-2026-96245
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.5CVE-2026-96232
Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
- HIGH 7.5CVE-2026-85808
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.5CVE-2026-85353
Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.
- HIGH 7.5CVE-2026-85334
Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.5CVE-2026-83856
Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.
- HIGH 7.5CVE-2026-83843
Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
- HIGH 7.5CVE-2026-83795
Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.
- HIGH 7.5CVE-2026-83670
Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.
- HIGH 7.5CVE-2026-83655
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.
- HIGH 7.5CVE-2026-83647
Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.
- HIGH 7.5CVE-2026-83635
Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.
windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022 · windows server 2025
- HIGH 7.5CVE-2026-83516
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
- HIGH 7.5CVE-2026-70281
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 7.5CVE-2026-69577
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
- HIGH 7.5CVE-2026-69454
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
- HIGH 7.5CVE-2026-103569
Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.
- HIGH 7.5CVE-2026-95114public PoC
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service
- HIGH 7.5CVE-2026-103636public PoC
Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized …
- HIGH 7.5CVE-2026-75351public PoC
OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.
- HIGH 7.5CVE-2026-75348public PoC
An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional so…
- HIGH 7.5CVE-2026-75346public PoC
An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote attacker to cause a denial of service
- HIGH 7.5CVE-2026-107302public PoC
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked …
- HIGH 7.5CVE-2026-16161
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
datapower gateway
- HIGH 7.5CVE-2026-87671
An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical r…
fabric operating system
- HIGH 7.5CVE-2026-96399public PoC
A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository…
- HIGH 7.5CVE-2026-104433public PoC
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the…
- HIGH 7.5CVE-2026-79896
Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normally restart…
- HIGH 7.5CVE-2026-102717public PoC
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
- HIGH 7.5CVE-2026-85644
XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV() rath…
- HIGH 7.5CVE-2026-88345public PoC
An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema ends with an unterminated quotation mark, the C-string scanning logic in lex() dereferences the input pointer after it has reached the en…
- HIGH 7.5CVE-2026-77558
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
- HIGH 7.5CVE-2026-77556
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
- HIGH 7.5CVE-2026-67857public PoC
open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua_client_connect.c.
- HIGH 7.4CVE-2026-121197
Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- HIGH 7.4CVE-2026-121160
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 7.4CVE-2026-121032
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- HIGH 7.4CVE-2026-120830
A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause …
- HIGH 7.4CVE-2026-93543
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
- HIGH 7.3CVE-2026-124586public PoC
A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate…
- HIGH 7.3CVE-2026-116620public PoC
A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds …
- HIGH 7.3CVE-2026-110679public PoC
A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version…
- HIGH 7.3CVE-2026-65150public PoC
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service.
- HIGH 7.3CVE-2026-65147public PoC
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.
- HIGH 7.3CVE-2026-88369public PoC
zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump().
- HIGH 7.2CVE-2026-108906public PoC
A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the att…
- HIGH 7.1CVE-2026-120757public PoC
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using str…
hdf5
- HIGH 7.1CVE-2026-121511
Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter allows Local Attacker to Read Memory and Reliably Cause DoS
- HIGH 7.1CVE-2026-113912
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a malic…
- HIGH 7.1CVE-2026-82947
SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them a…
- HIGH 7.1CVE-2026-115486
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker…
- HIGH 7.1CVE-2026-112260
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.
- HIGH 7.1CVE-2026-76665
A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.
- HIGH 7.1CVE-2026-19673public PoC
ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the …
- HIGH 7.1CVE-2026-102056
An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configure…
- HIGH 7.1CVE-2026-70126
Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.
- HIGH 7.1CVE-2026-85968
Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited inform…
- HIGH 7.1CVE-2026-19577public PoC
net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking whether the neighbor cache entry actually had a linked link-layer address. An unresolved neighbor carries i…
- HIGH 7.1CVE-2026-107611
An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap memory beyond the palette allocation and crash the viewer by sending ZRLE-encoded tiles whos…
- HIGH 7.1CVE-2026-93306
IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a …
power system e1080 \(9080-hex\) firmware · power system e1080 \(9080-hex\) · power system e1180 \(9080-heu\) firmware · power system e1180 \(9080-heu\) · power system s922 \(9009-22g\) firmware · power system s922 \(9009-22g\)
- HIGH 7.1CVE-2026-92925public PoC
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious …
- HIGH 7.1CVE-2026-76870public PoC
Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtd_write pre-flash validation routine triggered by short firmware uploads. Attackers can upload a truncated firmware image via put_file_cgi.c to trigger out-of-bounds reads…
- HIGH 7CVE-2026-125211public PoC
FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaption_trans_ass_subtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using region_count instead of num_rects. Attackers can supply crafted ARIB capt…
- HIGH 7CVE-2026-58100
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's…
freebsd
- HIGH 7CVE-2026-96209
Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-85853
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83694
Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.
- MEDIUM 6.8CVE-2026-83776
Out-of-bounds read in Microsoft Bluetooth Driver allows an unauthorized attacker to elevate privileges with a physical attack.
- MEDIUM 6.8CVE-2026-18747public PoC
The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rx_ctxt->nb->len -= 2U; in mcumgr_serial_process_frag() (subsys/mgmt/mcumgr/transport/src/s…
- MEDIUM 6.7CVE-2026-47544public PoC
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privilege…
- MEDIUM 6.7CVE-2026-47527public PoC
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, …
- MEDIUM 6.7CVE-2026-47524public PoC
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of pri…
- MEDIUM 6.7CVE-2026-47515public PoC
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read via an unbounded string operation. A successful exploit of this vulnerability might lead to code execution, denial…
- MEDIUM 6.5CVE-2026-115473public PoC
Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_ht…
- MEDIUM 6.5CVE-2026-86954
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27, visionOS 27, watchOS 27. Processing a malicio…
- MEDIUM 6.5CVE-2026-112634
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted …
- MEDIUM 6.5CVE-2026-112629
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted …
- MEDIUM 6.5CVE-2026-104592public PoC
libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker to cause a denial of service.
- MEDIUM 6.5CVE-2026-115680
Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission
- MEDIUM 6.5CVE-2026-107080public PoC
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
- MEDIUM 6.5CVE-2026-82943
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating the…
- MEDIUM 6.5CVE-2026-114043public PoC
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assumi…
- MEDIUM 6.5CVE-2026-114041public PoC
FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the c…
- MEDIUM 6.5CVE-2026-113329public PoC
Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · macos
- MEDIUM 6.5CVE-2026-113310
Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- MEDIUM 6.5CVE-2026-113309
Out of bounds read in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- MEDIUM 6.5CVE-2026-113295
Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome · windows
- MEDIUM 6.5CVE-2026-113277
Out of bounds read in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · android
- MEDIUM 6.5CVE-2026-113199
Out of bounds read in Payments in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- MEDIUM 6.5CVE-2026-113151
Out of bounds read in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- MEDIUM 6.5CVE-2026-113102
Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- MEDIUM 6.5CVE-2026-113070
Out of bounds read in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- MEDIUM 6.5CVE-2026-113054
Out of bounds read in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- MEDIUM 6.5CVE-2026-113050
Out of bounds read in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- MEDIUM 6.5CVE-2026-113045
Out of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · android
- MEDIUM 6.5CVE-2026-113035public PoC
Out of bounds read in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- MEDIUM 6.5CVE-2026-113010public PoC
Out of bounds read in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- MEDIUM 6.5CVE-2026-86957
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in wireless prox…
- MEDIUM 6.5CVE-2026-112279public PoC
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/…
- MEDIUM 6.5CVE-2026-112278public PoC
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a t…
- MEDIUM 6.5CVE-2026-112277public PoC
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short…
- MEDIUM 6.5CVE-2026-108455
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-108453
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-108436
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
- MEDIUM 6.5CVE-2026-108434
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
- MEDIUM 6.5CVE-2026-79843
A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption.
- MEDIUM 6.5CVE-2026-110713public PoC
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned…
- MEDIUM 6.5CVE-2026-110712public PoC
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on uns…
- MEDIUM 6.5CVE-2026-97844
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97843
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97842
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97841
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97840
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97839
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97838
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97837
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97836
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97835
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97834
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97833
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97832
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97831
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97829
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97827
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97826
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97825
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97824
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97823
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97822
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97821
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97820
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97819
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97779
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- MEDIUM 6.5CVE-2026-97760
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- MEDIUM 6.5CVE-2026-94506
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.
365 apps · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88192
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88190
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88184
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88183
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88175
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88172
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88169
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88154
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88153
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88151
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88130
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022 · windows server 2025
- MEDIUM 6.5CVE-2026-88129
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022 · windows server 2025
- MEDIUM 6.5CVE-2026-88125
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022 · windows server 2025
- MEDIUM 6.5CVE-2026-88123
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022 · windows server 2025
- MEDIUM 6.5CVE-2026-88122
Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.
windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022 · windows server 2025
- MEDIUM 6.5CVE-2026-85847
Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.
- MEDIUM 6.5CVE-2026-85821
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-85797
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-85337
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-85331
Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-84007
Out-of-bounds read in Remote Desktop Gateway Service allows an authorized attacker to disclose information over a network.
windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022 · windows server 2025
- MEDIUM 6.5CVE-2026-83703
Out-of-bounds read in Windows Wi-Fi Driver allows an unauthorized attacker to deny service over an adjacent network.
- MEDIUM 6.5CVE-2026-83671
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.
- MEDIUM 6.5CVE-2026-83667
Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network.
- MEDIUM 6.5CVE-2026-83651
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
- MEDIUM 6.5CVE-2026-83649
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
- MEDIUM 6.5CVE-2026-83521
Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information over a network.
- MEDIUM 6.5CVE-2026-70263
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-70244
Out-of-bounds read in DNS Server allows an unauthorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-70219
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-70206
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-70166
Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network.
windows 10 1607 · windows 10 1809 · windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022
- MEDIUM 6.5CVE-2026-70119
Out-of-bounds read in Windows DNS allows an authorized attacker to execute code over a network.
windows server 2022 · windows server 2025
- MEDIUM 6.5CVE-2026-69955
Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-69940
Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-69922
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-108129
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-108128
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-108127
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-102867
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
365 apps · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-81507public PoC
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths again…
- MEDIUM 6.5CVE-2026-109677public PoC
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an ora…
- MEDIUM 6.5CVE-2026-109248public PoC
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(), which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded _wcschr() and count_special_chars() calls without a …
- MEDIUM 6.5CVE-2026-14988
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.
datapower gateway
- MEDIUM 6.5CVE-2026-107220public PoC
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. …
excelize
- MEDIUM 6.5CVE-2026-94283
An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.
- MEDIUM 6.5CVE-2026-94281
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
- MEDIUM 6.5CVE-2026-93545
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
- MEDIUM 6.5CVE-2026-93544
An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.
- MEDIUM 6.5CVE-2026-93542
An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client.
- MEDIUM 6.5CVE-2026-93541
An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a
- MEDIUM 6.5CVE-2026-88358public PoC
simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause json_iterator::walk_document() to access bu…
- MEDIUM 6.5CVE-2026-74765public PoC
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation `de…
- MEDIUM 6.5CVE-2026-73462
On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP …
- MEDIUM 6.5CVE-2026-56719
MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the request buffer by supplying a crafted uniPwdLen field value in a minimal SMB1 SessionSetu…
- MEDIUM 6.5CVE-2026-73436
On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.
- MEDIUM 6.5CVE-2026-70368
A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message long…
- MEDIUM 6.4CVE-2026-76664
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations
- MEDIUM 6.4CVE-2026-107816public PoC
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info …
mariadb
- MEDIUM 6.3CVE-2026-124996public PoC
A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routing_sel_norm_kernel of the file exllamav3/exllamav3_ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2eid…
- MEDIUM 6.3CVE-2026-124994public PoC
A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file exllamav3/exllamav3_ext/ngram.cu of the component NGramEmbedding. The manipulation of the argument head_bias results in o…
- MEDIUM 6.3CVE-2026-122189public PoC
A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such ma…
- MEDIUM 6.3CVE-2026-65138
NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.
- MEDIUM 6.3CVE-2026-116463
A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor …
- MEDIUM 6.3CVE-2026-115485
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte…
- MEDIUM 6.3CVE-2026-112073public PoC
A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. …
- MEDIUM 6.3CVE-2026-110694public PoC
A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the component tmfile Model Loader. Such manipulation of the argument offset_root lea…
- MEDIUM 6.3CVE-2026-105251public PoC
A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file src/coding/psx_decoder.c of the component VAG File Handler. Performing a manipulation results in out-of-bounds read. The attack is…
- MEDIUM 6.3CVE-2026-101205
A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out-of-bounds read. The attack may be initiated remotely. The vendor was contacted early about this disc…
- MEDIUM 6.3CVE-2026-101204
A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was con…
- MEDIUM 6.2CVE-2026-115920public PoC
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an emp…
- MEDIUM 6.2CVE-2026-115919public PoC
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInference_opset1_to_6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifyi…
- MEDIUM 6.2CVE-2026-92824
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multipl…
- MEDIUM 6.2CVE-2026-102820public PoC
pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a pe…
- MEDIUM 6.1CVE-2026-125261public PoC
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorota…
- MEDIUM 6.1CVE-2026-125193public PoC
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpacked_decode_uyvy422() in libavcodec/bitpacked_dec.c because it never verifies packets hold width * height * 2 bytes. Attackers can supply truncated bitpacked UYVY422 packets via crafted …
- MEDIUM 6.1CVE-2026-125178public PoC
FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc_pain…
- MEDIUM 6.1CVE-2026-125172public PoC
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL…
- MEDIUM 6.1CVE-2026-125171public PoC
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7_decode_init() does not validate lastframelen against MPC_FRAME_SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame,…
- MEDIUM 6.1CVE-2026-121601
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within th…
- MEDIUM 6.1CVE-2026-124309public PoC
Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supply a craft…
- MEDIUM 6.1CVE-2026-73471
A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, a…
- MEDIUM 6.1CVE-2026-121942public PoC
ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pa…
- MEDIUM 6.1CVE-2026-120756public PoC
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message h…
hdf5
- MEDIUM 6.1CVE-2026-120437
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-ma…
- MEDIUM 6.1CVE-2026-119721
Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when brows…
blender
- MEDIUM 6.1CVE-2026-104063public PoC
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or i…
- MEDIUM 6.1CVE-2026-117557public PoC
SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes…
- MEDIUM 6.1CVE-2024-58399public PoC
llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbit…
- MEDIUM 6.1CVE-2026-116736public PoC
Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to …
- MEDIUM 6.1CVE-2026-92454public PoC
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes …
- MEDIUM 6.1CVE-2026-112276
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palett…
- MEDIUM 6.1CVE-2026-112020public PoC
LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger tha…
- MEDIUM 6.1CVE-2026-112019public PoC
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to read…
- MEDIUM 6.1CVE-2026-111269public PoC
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to re…
- MEDIUM 6.1CVE-2024-58397public PoC
MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared…
- MEDIUM 6.1CVE-2026-111167public PoC
GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+…
- MEDIUM 6.1CVE-2026-111162public PoC
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wr…
- MEDIUM 6.1CVE-2026-111159public PoC
libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' met…
- MEDIUM 6.1CVE-2026-111155public PoC
libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through mid_set…
- MEDIUM 6.1CVE-2026-111149public PoC
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated …
- MEDIUM 6.1CVE-2026-111147public PoC
Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed…
- MEDIUM 6.1CVE-2026-111146public PoC
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL termi…
- MEDIUM 6.1CVE-2026-111145public PoC
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAP…
- MEDIUM 6.1CVE-2026-111140public PoC
libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value d…
- MEDIUM 6.1CVE-2026-111135public PoC
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item dat…
- MEDIUM 6.1CVE-2026-111134public PoC
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with …
- MEDIUM 6.1CVE-2026-111133public PoC
libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or…
- MEDIUM 6.1CVE-2026-111132
GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not…
- MEDIUM 6.1CVE-2026-111131public PoC
libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference s…
- MEDIUM 6.1CVE-2026-111130public PoC
OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does…
- MEDIUM 6.1CVE-2026-111127public PoC
catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte c…
- MEDIUM 6.1CVE-2026-111126public PoC
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or …
- MEDIUM 6.1CVE-2026-111125public PoC
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMP…
- MEDIUM 6.1CVE-2026-111124public PoC
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS …
- MEDIUM 6.1CVE-2026-110598public PoC
Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT_…
- MEDIUM 6.1CVE-2026-110597public PoC
Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part …
- MEDIUM 6.1CVE-2026-107634public PoC
Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or da…
- MEDIUM 6.1CVE-2026-107614
An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or hei…
- MEDIUM 6.1CVE-2026-102567public PoC
CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, caus…
- MEDIUM 6.1CVE-2026-88835
BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.
- MEDIUM 6.1CVE-2026-91817
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and appl…
- MEDIUM 6.1CVE-2026-91810
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and applicati…
- MEDIUM 6.1CVE-2026-91808
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read d…
- MEDIUM 6.1CVE-2026-91807
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of…
- MEDIUM 6CVE-2026-78628
The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the credential pr…
- MEDIUM 5.9CVE-2026-120060public PoC
psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed…
- MEDIUM 5.9CVE-2026-119299public PoC
gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParamet…
- MEDIUM 5.9CVE-2026-119277public PoC
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used serv…
- MEDIUM 5.9CVE-2026-92842public PoC
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(…
- MEDIUM 5.9CVE-2026-81645
Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability.
- MEDIUM 5.8CVE-2026-93682public PoC
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect t…
- MEDIUM 5.7CVE-2026-121093
Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
chrome
- MEDIUM 5.7CVE-2026-76667
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
- MEDIUM 5.7CVE-2026-85816
Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disclose information over an adjacent network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.7CVE-2026-102507public PoC
Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. A…
- MEDIUM 5.6CVE-2026-94282
An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.
- MEDIUM 5.5CVE-2026-125194public PoC
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short fina…
- MEDIUM 5.5CVE-2026-120755public PoC
HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the c…
hdf5
- MEDIUM 5.5CVE-2026-59048
In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
android
- MEDIUM 5.5CVE-2026-119720
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, wh…
blender
- MEDIUM 5.5CVE-2026-48380
Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in…
- MEDIUM 5.5CVE-2026-116841public PoC
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archi…
- MEDIUM 5.5CVE-2025-71439public PoC
llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.token…
- MEDIUM 5.5CVE-2026-116730public PoC
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker m…
- MEDIUM 5.5CVE-2026-116728public PoC
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not checked against the source metadata block. Attackers can supply a crafted FileVault 2 Core Storage vol…
- MEDIUM 5.5CVE-2026-116725public PoC
gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious …
- MEDIUM 5.5CVE-2025-71438public PoC
An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
- MEDIUM 5.5CVE-2025-60494public PoC
A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.
- MEDIUM 5.5CVE-2026-112282
VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIP…
- MEDIUM 5.5CVE-2026-112272
Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious …
- MEDIUM 5.5CVE-2026-112271
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, …
- MEDIUM 5.5CVE-2026-112058
VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play…
- MEDIUM 5.5CVE-2026-112057
libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a crafted DVD or disc image de…
- MEDIUM 5.5CVE-2026-112056public PoC
wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-…
- MEDIUM 5.5CVE-2026-112055public PoC
wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stac…
- MEDIUM 5.5CVE-2026-112053public PoC
Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-de…
- MEDIUM 5.5CVE-2026-112009public PoC
smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table b…
- MEDIUM 5.5CVE-2026-111677public PoC
Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffe…
- MEDIUM 5.5CVE-2026-111274public PoC
unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 rec…
- MEDIUM 5.5CVE-2026-111272public PoC
LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash …
- MEDIUM 5.5CVE-2026-111271public PoC
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect by…
- MEDIUM 5.5CVE-2026-111166public PoC
libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-…
- MEDIUM 5.5CVE-2026-111165public PoC
libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static …
- MEDIUM 5.5CVE-2026-111164
UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads f…
- MEDIUM 5.5CVE-2026-111163public PoC
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read…
- MEDIUM 5.5CVE-2026-111158public PoC
EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2_ISVALIDHEADER to msr3_parse() or ms3…
- MEDIUM 5.5CVE-2026-111153public PoC
Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craf…
- MEDIUM 5.5CVE-2026-111152public PoC
Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table…
- MEDIUM 5.5CVE-2026-111150public PoC
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compre…
- MEDIUM 5.5CVE-2026-111148public PoC
libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the len…
- MEDIUM 5.5CVE-2026-111143public PoC
Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte su…
- MEDIUM 5.5CVE-2026-111142public PoC
Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the b…
- MEDIUM 5.5CVE-2026-111139public PoC
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multipl…
- MEDIUM 5.5CVE-2026-111138public PoC
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length a…
- MEDIUM 5.5CVE-2026-110877public PoC
AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unp…
- MEDIUM 5.5CVE-2026-110876public PoC
AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, caus…
- MEDIUM 5.5CVE-2026-110716public PoC
unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-rang…
- MEDIUM 5.5CVE-2026-103825
Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction i…
substance 3d designer · macos · windows
- MEDIUM 5.5CVE-2026-103822
Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction i…
substance 3d designer · macos · windows
- MEDIUM 5.5CVE-2026-100131
Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in…
- MEDIUM 5.5CVE-2026-100130
Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in…
- MEDIUM 5.5CVE-2026-100126
Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim …
- MEDIUM 5.5CVE-2026-103853
Dimension is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a vict…
- MEDIUM 5.5CVE-2026-103850
Substance3D - Stager is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in …
- MEDIUM 5.5CVE-2026-97744
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 5.5CVE-2026-97014
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
365 apps · office 2021 · office 2024
- MEDIUM 5.5CVE-2026-97005
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 5.5CVE-2026-96930
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-96927
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-96860
Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-96859
Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-96846
Out-of-bounds read in WebDAV allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-96321
Out-of-bounds read in Remote Desktop Display Driver allows an authorized attacker to disclose information locally.
windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h1
- MEDIUM 5.5CVE-2026-96314
Out-of-bounds read in Windows Audio Service allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-88158
Out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-88140
Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-87698
Out-of-bounds read in Windows Remote Access Service Infrastructure allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-85852
Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-85830
Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-85815
Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-85794
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-85374
Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-85336
Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-83904
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83898
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83892
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83887
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83884
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83875
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83870
Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83849
Out-of-bounds read in Windows Hello allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83794
Out-of-bounds read in Windows Portable Device MTP Driver allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83765
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83760
Out-of-bounds read in Microsoft Bluetooth Driver allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83747
Out-of-bounds read in Windows Error Reporting allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83737
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83733
Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83686
Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83668
Out-of-bounds read in Windows WLAN Service allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70295
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70294
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70292
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70277
Out-of-bounds read in Windows Fast FAT Driver allows an unauthorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70227
Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70214
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
365 apps · office 2021 · office 2024
- MEDIUM 5.5CVE-2026-70211
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70208
Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70201
Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service locally.
- MEDIUM 5.5CVE-2026-70173
Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70141
Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70135
Out-of-bounds read in Windows Remote POS Driver allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70128
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70074
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022
- MEDIUM 5.5CVE-2026-70044
Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-70011
Out-of-bounds read in Windows IP Over USB Service allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-69999
Out-of-bounds read in Windows Update allows an authorized attacker to disclose information locally.
windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h1 · windows 11 26h2 · windows server 2025
- MEDIUM 5.5CVE-2026-69967
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-69919
Out-of-bounds read in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
windows 11 24h2 · windows 11 25h2 · windows 11 26h1 · windows 11 26h2 · windows server 2025
- MEDIUM 5.5CVE-2026-69914
Out-of-bounds read in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- MEDIUM 5.5CVE-2026-69721
Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-69675
Out-of-bounds read in Windows Network File System allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-105726
Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-103857
Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that…
- MEDIUM 5.5CVE-2026-103856
Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that…
- MEDIUM 5.5CVE-2026-105460
A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the a…
- MEDIUM 5.5CVE-2026-109249public PoC
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. At…
- MEDIUM 5.5CVE-2026-108573
A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible…
- MEDIUM 5.5CVE-2026-107731public PoC
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. T…
- MEDIUM 5.5CVE-2026-107729public PoC
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag i…
- MEDIUM 5.5CVE-2026-46571public PoC
In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is tr…
ntfs-3g
- MEDIUM 5.5CVE-2026-106061
A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is small…
- MEDIUM 5.5CVE-2026-65122public PoC
NVIDIA TensorRT contains a vulnerability where an attacker can cause an out of bounds read. A successful exploit of this vulnerability may lead to denial of service.
- MEDIUM 5.5CVE-2026-105838public PoC
libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows…
- MEDIUM 5.5CVE-2026-104043
A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory re…
- MEDIUM 5.5CVE-2026-104042
A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. Due to missing input validation, the servic…
- MEDIUM 5.5CVE-2026-104037
A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the r…
- MEDIUM 5.5CVE-2026-104030
A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory…
- MEDIUM 5.5CVE-2026-103641
A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader.
- MEDIUM 5.5CVE-2026-94284
An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.
- MEDIUM 5.5CVE-2026-75656
Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim …
bridge
- MEDIUM 5.5CVE-2026-81879public PoC
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but several consumers still …
radare2
- MEDIUM 5.5CVE-2026-68743
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM r…
- MEDIUM 5.4CVE-2026-81858
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.
i
- MEDIUM 5.4CVE-2026-103678public PoC
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in ge…
tnef
- MEDIUM 5.4CVE-2026-92255public PoC
Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component…
- MEDIUM 5.3CVE-2026-14918
The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device'…
- MEDIUM 5.3CVE-2026-125270public PoC
FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 …
- MEDIUM 5.3CVE-2026-125228public PoC
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds read vulnerability in put_vector() in libavcodec/vorbisenc.c when NaN samples leave the codebook entry at -1. Attackers can supply audio with NaN float samples to the native Vorbis encoder, cau…
- MEDIUM 5.3CVE-2026-104254public PoC
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. From 0.11.0 through 0.16.0, builds configured with OQS_ENABLE_SIG_STFL_LMS=ON can read beyond a caller-supplied signature buffer when an untrust…
- MEDIUM 5.3CVE-2026-75615public PoC
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg…
- MEDIUM 5.3CVE-2026-19319
IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
- MEDIUM 5.3CVE-2026-59007
In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitati…
android
- MEDIUM 5.3CVE-2026-58933
In process of C2SoftApvDec.cpp, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- MEDIUM 5.3CVE-2026-68590
In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User in…
- MEDIUM 5.3CVE-2026-20598
In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction…
- MEDIUM 5.3CVE-2026-20597
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interact…
- MEDIUM 5.3CVE-2026-20596
In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User inter…
- MEDIUM 5.3CVE-2026-20594
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interact…
- MEDIUM 5.3CVE-2026-20561
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interac…
- MEDIUM 5.3CVE-2026-20560
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction…
- MEDIUM 5.3CVE-2026-20555
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interact…
- MEDIUM 5.3CVE-2026-119053public PoC
lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragm…
- MEDIUM 5.3CVE-2026-103390
An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to cause a denial of service via a specially crafted HTTP request.
- MEDIUM 5.3CVE-2026-116744public PoC
ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-cl…
- MEDIUM 5.3CVE-2026-115801public PoC
A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hidden_dim/cl…
- MEDIUM 5.3CVE-2026-114044public PoC
FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX_MAP_…
- MEDIUM 5.3CVE-2026-113868
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, dis…
- MEDIUM 5.3CVE-2026-112273public PoC
libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets …
- MEDIUM 5.3CVE-2026-110658public PoC
Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Ty…
- MEDIUM 5.3CVE-2026-88086
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.
- MEDIUM 5.3CVE-2026-108466
Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network.
- MEDIUM 5.3CVE-2026-102198
Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network.
- MEDIUM 5.3CVE-2026-109951public PoC
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATE_RE…
- MEDIUM 5.3CVE-2026-89208
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All version…
- MEDIUM 5.3CVE-2026-108960public PoC
A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_mat_to_gpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulat…
- MEDIUM 5.3CVE-2026-108955public PoC
A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf_init_from_file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data_offset causes out-of-boun…
- MEDIUM 5.3CVE-2026-109269public PoC
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for process…
- MEDIUM 5.3CVE-2026-109265public PoC
ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profil…
- MEDIUM 5.3CVE-2026-109253public PoC
FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such a…
- MEDIUM 5.3CVE-2026-108103public PoC
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modific…
- MEDIUM 5.3CVE-2026-108102public PoC
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF …
- MEDIUM 5.3CVE-2026-16177
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.
datapower gateway
- MEDIUM 5.3CVE-2026-106574public PoC
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap bu…
- MEDIUM 5.3CVE-2026-20534
In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User inter…
- MEDIUM 5.3CVE-2026-88840
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
- MEDIUM 5.3CVE-2026-17054public PoC
The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For control frames it took the 16-bit TLV field data_length straight off the wire and passed it to pb_istream…
- MEDIUM 5.3CVE-2026-45705public PoC
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delim…
- MEDIUM 5.2CVE-2026-102485
Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.
- MEDIUM 5.1CVE-2026-114038
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memo…
- MEDIUM 5.1CVE-2026-106435
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_a…
- MEDIUM 5.1CVE-2026-94285
An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.
- MEDIUM 5CVE-2026-111376public PoC
FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SI…
- MEDIUM 4.9CVE-2026-96582public PoC
A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor o…
- MEDIUM 4.9CVE-2026-96406public PoC
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors,…
- MEDIUM 4.9CVE-2026-67628
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
- MEDIUM 4.8CVE-2026-111375public PoC
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIE…
- MEDIUM 4.7CVE-2026-124312public PoC
Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying a collocated picture of different resolution. Attackers can craft a VVC bitstream enabling TMVP with a smaller collocate…
- MEDIUM 4.7CVE-2026-111141public PoC
zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafte…
- MEDIUM 4.7CVE-2026-76666
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
- MEDIUM 4.7CVE-2026-70063
Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally.
- MEDIUM 4.7CVE-2026-69974
Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally.
- MEDIUM 4.7CVE-2026-69506
Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.
- MEDIUM 4.7CVE-2026-106304
Out of bounds read in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- MEDIUM 4.7CVE-2026-106284
Out of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium secur…
chrome · windows
- MEDIUM 4.7CVE-2026-102318
Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- MEDIUM 4.7CVE-2026-91726
Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
chrome · android
- MEDIUM 4.6CVE-2026-116487public PoC
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OI…
- MEDIUM 4.6CVE-2026-88226
Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose information with a physical attack.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 4.4CVE-2026-116732public PoC
libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing d…
- MEDIUM 4.4CVE-2026-109281public PoC
ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression pr…
- MEDIUM 4.4CVE-2026-107817public PoC
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL …
mariadb
- MEDIUM 4.4CVE-2026-44038public PoC
A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_test[] and extend_offset[] tables, causing incorrectly decode…
- MEDIUM 4.4CVE-2026-44034public PoC
A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data …
- MEDIUM 4.4CVE-2026-100505public PoC
Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries co…
- MEDIUM 4.4CVE-2026-96545
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. Th…
- MEDIUM 4.3CVE-2026-121397public PoC
FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CF_DIB BI_BITFIELDS image that, when converted to P…
freerdp
- MEDIUM 4.3CVE-2026-121387public PoC
FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 mes…
freerdp
- MEDIUM 4.3CVE-2026-93009
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigge…
- MEDIUM 4.3CVE-2026-103393
An Out-of-Bounds Read vulnerability in the VRRP implementation in Juniper Networks Session Smart Router allows an L2-adjacent attacker to read stale memory contents or cause a system fault via a specially crafted VRRPv3 advertisement.
- MEDIUM 4.3CVE-2026-58496public PoC
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the…
- MEDIUM 4.3CVE-2026-117556public PoC
zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends i…
- MEDIUM 4.3CVE-2026-87849public PoC
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or …
- MEDIUM 4.3CVE-2026-100132
Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that…
- MEDIUM 4.3CVE-2026-86975
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination.
- MEDIUM 4.3CVE-2026-112061
librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending wi…
- MEDIUM 4.3CVE-2026-109950public PoC
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string Actua…
- MEDIUM 4.3CVE-2026-105775public PoC
A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manipulation leads to out-of…
- MEDIUM 4.3CVE-2026-81508public PoC
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout…
- MEDIUM 4.3CVE-2026-18870
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
power system s1122 \(9824-22a\) firmware · power system s1122 \(9824-22a\) · power system s1124 \(9824-42a\) firmware · power system s1124 \(9824-42a\) · power system s1122s \(9824-22b\) firmware · power system s1122s \(9824-22b\)
- MEDIUM 4.2CVE-2026-75085public PoC
The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length - IEEE802154_FCS_LENGTH without first checking that the radio-reported length could hold an FCS. pkt_len …
- MEDIUM 4CVE-2026-58997
In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- LOW 3.9CVE-2026-114124public PoC
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering was not fully validate…
- LOW 3.9CVE-2026-114122public PoC
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for webContents.beginFrameSubscription was not fully…
- LOW 3.7CVE-2026-90588public PoC
The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser data-callback slice with a %s conversion: snprintk(output, len + 1, "%s", str). The parser hands its callbacks a pointer and a length into the cal…
- LOW 3.7CVE-2026-121626public PoC
GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP pa…
- LOW 3.7CVE-2026-121625public PoC
GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy …
- LOW 3.7CVE-2026-121505
An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in clearte…
- LOW 3.7CVE-2026-115456
A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potent…
- LOW 3.7CVE-2026-116733public PoC
flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal p…
- LOW 3.7CVE-2026-116544public PoC
Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte…
- LOW 3.7CVE-2026-114459
A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically …
- LOW 3.7CVE-2026-112274public PoC
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to application…
- LOW 3.7CVE-2026-12091
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a denial of service due to a heap-based out-of-bounds read. A remote attacker could send a specially crafted request that causes a limited out‑of‑bo…
security verify access · security verify access container · verify identity access · verify identity access container
- LOW 3.7CVE-2026-106428
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-si…
- LOW 3.7CVE-2026-106026
tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests whose filename matches a remap jump ru…
- LOW 3.7CVE-2026-18416public PoC
The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k on…
- LOW 3.6CVE-2026-118475
A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a ma…
- LOW 3.6CVE-2026-108330
Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.
- LOW 3.6CVE-2026-96395
The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an …
- LOW 3.6CVE-2026-77797public PoC
Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.
- LOW 3.5CVE-2026-85498
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable …
- LOW 3.5CVE-2026-118608
Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An…
- LOW 3.5CVE-2026-116261
A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to in…
- LOW 3.5CVE-2026-18748public PoC
The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte codec_ie[] array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dp_process_config_ind() in subsys/bluetooth…
- LOW 3.5CVE-2026-101946
An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent low-privilege attacker to disclose limited rpd process memory and disrupt an LDP adjacency via an IPv6 LDP message.
- LOW 3.4CVE-2026-18418public PoC
The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus_proxy_msg carries a fixed-size channel_name[] array as its last m…
- LOW 3.4CVE-2026-18857
IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a lim…
power system s1122 \(9824-22a\) firmware · power system s1122 \(9824-22a\) · power system s1124 \(9824-42a\) firmware · power system s1124 \(9824-42a\) · power system s1122s \(9824-22b\) firmware · power system s1122s \(9824-22b\)
- LOW 3.3CVE-2026-125182public PoC
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because cook_decode_init() does not check js_subband_start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes read…
- LOW 3.3CVE-2026-123269public PoC
A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds …
- LOW 3.3CVE-2026-121049
Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity: Medium)
chrome
- LOW 3.3CVE-2026-121604
wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated cla…
- LOW 3.3CVE-2026-120453public PoC
The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr…
- LOW 3.3CVE-2026-112922
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of …
- LOW 3.3CVE-2026-116729public PoC
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plist…
- LOW 3.3CVE-2026-116727public PoC
gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buff…
- LOW 3.3CVE-2026-116726public PoC
Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffe…
- LOW 3.3CVE-2026-116142public PoC
ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box …
- LOW 3.3CVE-2026-86874
An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination.
- LOW 3.3CVE-2026-112284public PoC
libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC …
- LOW 3.3CVE-2026-111678public PoC
Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 51…
- LOW 3.3CVE-2026-110661public PoC
CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADF…
- LOW 3.3CVE-2026-110660public PoC
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_…
- LOW 3.3CVE-2026-110606public PoC
LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC102…
- LOW 3.3CVE-2024-58392public PoC
PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry na…
- LOW 3.3CVE-2026-88842
A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be drop…
- LOW 3.3CVE-2026-106399
Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. (Chromium security severity: Low)
chrome
- LOW 3.3CVE-2026-104029
A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory…
- LOW 3.3CVE-2026-81883public PoC
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5.3 bytecode function parser read fixed function-metadata fields immediately after a functi…
radare2
- LOW 3.3CVE-2026-81882public PoC
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and di…
radare2
- LOW 3.3CVE-2026-81881public PoC
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtra…
radare2
- LOW 3.3CVE-2026-18790public PoC
A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse of the file src/ClientServer/frontend/client_wrapper/internal/state_machine.c of the component DeleteMonitoredItemsRequ…
- LOW 3.1CVE-2026-12669
IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.
mq operator · supplied mq advanced container images
- LOW 3.1CVE-2026-110656public PoC
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network …
- LOW 3.1CVE-2026-110655public PoC
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving de…
- LOW 3.1CVE-2026-102164
On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory cont…
- LOW 2.8CVE-2026-110810public PoC
A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_model_load of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-bounds read. The attack …
- LOW 2.7CVE-2026-116780public PoC
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_event_expand_headers_check() advanced beyond its heap…
- LOW 2.7CVE-2026-105164public PoC
A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulation causes out-of-bounds read. Remote exploitation of the attack is possible. The pull req…
- LOW 2.5CVE-2026-96546
A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug…
- LOW 2.5CVE-2026-81884public PoC
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because the Mach-O LC_DATA_IN_CODE parser trusted dataoff and datasize and allowed a final partial record to b…
radare2
- LOW 2CVE-2026-120740
A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application pro…
- UNSCOREDCVE-2026-70660public PoC
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/model_io/safetensors_io.cpp trusts each tensor's data_of…
- UNSCOREDCVE-2025-66367
Improper handling of NAS DLTransport messages may lead to a baseband crash.
- UNSCOREDCVE-2026-77372public PoC
VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.30, the Unix, macOS, and FreeBSD serialization paths in src/Platform/Serializer.cpp and src/Volume/VolumePassword.cpp accept untrusted length and count values when deseri…
- UNSCOREDCVE-2026-118237public PoC
An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An att…
- UNSCOREDCVE-2026-40660
A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local access to read out-of-bounds heap memory, potentially resulting in information disclosure or application crash.
- UNSCOREDCVE-2026-40652
An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted Truevision Advanced Raster Graphics Adapter (TGA) file to a user or an automated pipeline, potentially resulting in disclosure…
- UNSCOREDCVE-2026-118444
Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decod…
- UNSCOREDCVE-2026-103653
An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash (loss of availability) or to continue operatin…
- UNSCOREDCVE-2026-119338public PoC
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an …
- UNSCOREDCVE-2026-61627public PoC
libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap …
- UNSCOREDCVE-2026-118769public PoC
Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the F…
- UNSCOREDCVE-2026-115795
P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is r…
- UNSCOREDCVE-2026-111735
P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, …
- UNSCOREDCVE-2026-111734
P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN t…
- UNSCOREDCVE-2026-115942
A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Pro…
- UNSCOREDCVE-2026-57192public PoC
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds wr…
- UNSCOREDCVE-2026-93862
An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization proc…
- UNSCOREDCVE-2026-107472
An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffe…
- UNSCOREDCVE-2026-105946
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM cha…
- UNSCOREDCVE-2026-57184public PoC
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser`…
- UNSCOREDCVE-2026-107157
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.
- UNSCOREDCVE-2026-53920public PoC
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header t…
- UNSCOREDCVE-2026-79704
An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra_stream_id fo…
- UNSCOREDCVE-2026-61916
Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input …
- UNSCOREDCVE-2026-110938public PoC
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed net…
- UNSCOREDCVE-2026-111075public PoC
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote atta…
- UNSCOREDCVE-2026-112202public PoC
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond t…
- UNSCOREDCVE-2026-95109public PoC
The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation d…
- UNSCOREDCVE-2026-94202public PoC
The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words…
- UNSCOREDCVE-2026-94024public PoC
The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the reco…
- UNSCOREDCVE-2026-94023public PoC
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using* an object, and using a…
- UNSCOREDCVE-2026-92853public PoC
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, wh…
- UNSCOREDCVE-2026-92843public PoC
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reacha…
- UNSCOREDCVE-2026-91057public PoC
`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past the end of the string, p…
- UNSCOREDCVE-2026-96402public PoC
A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.
- UNSCOREDCVE-2026-95111public PoC
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's `tx_queue_message…
- UNSCOREDCVE-2026-92446public PoC
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose exte…
- UNSCOREDCVE-2026-91186public PoC
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first ch…
- UNSCOREDCVE-2026-91059public PoC
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `G…
- UNSCOREDCVE-2026-43849
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.
- UNSCOREDCVE-2026-101201
A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.
- UNSCOREDCVE-2026-112896public PoC
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap th…
- UNSCOREDCVE-2026-68907public PoC
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while …
- UNSCOREDCVE-2026-68906public PoC
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos…
- UNSCOREDCVE-2026-105228
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
- UNSCOREDCVE-2026-105227
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
- UNSCOREDCVE-2026-106464public PoC
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the…
- UNSCOREDCVE-2026-88964
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
- UNSCOREDCVE-2026-84420
Out-of-bounds read vulnerability in Citirx Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2603.20 CR, before LTSR 2607, and before LTSR 2507 CU3.
- UNSCOREDCVE-2026-107836public PoC
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Bl…
- UNSCOREDCVE-2026-107738public PoC
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to signed integers without a lower-bound check. An offset that becomes negative can make the fun…
- UNSCOREDCVE-2026-19029public PoC
A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (application crash) with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datat…
- UNSCOREDCVE-2026-75819
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An at…
- UNSCOREDCVE-2026-59782
The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.
- UNSCOREDCVE-2026-80490public PoC
Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified. The matches, first_match and match_details methods use the T_STD_STRING typemap to translate Perl scalars (SVs) into strings via the st…
- UNSCOREDCVE-2026-102757public PoC
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided wheth…
- UNSCOREDCVE-2026-102726public PoC
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
- UNSCOREDCVE-2026-102725public PoC
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
- UNSCOREDCVE-2026-102721public PoC
A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long (nxd_tftp_client.c:1229, 1521, 1984). When the opcode is …
- UNSCOREDCVE-2026-102720public PoC
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: ```c …
- UNSCOREDCVE-2026-102718public PoC
hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multiby…
- UNSCOREDCVE-2026-102714public PoC
`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the f…
- UNSCOREDCVE-2026-102713public PoC
The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER…
- UNSCOREDCVE-2026-102712public PoC
On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated peer drives an OOB source read of up to 255 b…
- UNSCOREDCVE-2026-102711public PoC
Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_txm_module_manager_in_place_load` — APIs that take ONLY a base pointer, no image length, so every size/…
- UNSCOREDCVE-2026-95509
Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.
- UNSCOREDCVE-2026-26054public PoC
SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual re…
- UNSCOREDCVE-2026-79616
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path.
- UNSCOREDCVE-2026-18626
Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 b…
- UNSCOREDCVE-2026-18458
Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: fro…
- UNSCOREDCVE-2026-11389
Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: fro…
- UNSCOREDCVE-2026-63279
LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the …
- UNSCOREDCVE-2026-63274
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the strea…
- UNSCOREDCVE-2026-63272
LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from…
- UNSCOREDCVE-2026-54579public PoC
mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. A network attacker able to inject or spoof vi…
- UNSCOREDCVE-2026-76151
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excess…