CWE-125 · Out-of-bounds Read (page 10)
Page 10 of 99 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-60103 | Medium | 6.1 | 2026-07-13 | Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a c… |
CVE-2026-57432 | High | 8.4 | 2026-07-13 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bo… |
CVE-2026-57158 | Critical | 9.1 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix fo… |
CVE-2026-57157 | Medium | 6.5 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, FreeRDP server implementations with the MS-RDPECAM camera device enumerator c… |
CVE-2026-14461 | | 2026-07-10 | mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT response used for AS lookups can trigge… | |
CVE-2026-40454 | High | 7.5 | 2026-07-10 | Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash clie… |
CVE-2026-11404 | High | 7.5 | 2026-07-09 | Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled s… |
CVE-2026-15185 | Low | 3.3 | 2026-07-09 | A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Exec… |
CVE-2026-58307 | Medium | 6.1 | 2026-07-09 | Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Esc… |
CVE-2026-58304 | Medium | 6.1 | 2026-07-09 | Out-of-bounds read, Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before 779f6bedf58… |
CVE-2026-15114 | High | 8.8 | 2026-07-08 | Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-29007 | Medium | 5.3 | 2026-07-08 | U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote… |
CVE-2026-56374 | Low | 3.3 | 2026-07-08 | ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote a… |
CVE-2026-56362 | Low | 3.3 | 2026-07-08 | ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before… |
CVE-2026-57258 | Medium | 6.1 | 2026-07-08 | The PRC file header parsing logic trusts the constructed file structure description information, assumes that the underlying array contains elements and reads… |
CVE-2026-57257 | Medium | 6.1 | 2026-07-08 | During the PRC parsing stage, there is a lack of boundary verification for the PRC entity index, which leads to an out-of-bounds read of the entity array. As a… |
CVE-2026-57255 | Medium | 6.1 | 2026-07-08 | The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The function's output is… |
CVE-2026-57253 | Medium | 6.1 | 2026-07-08 | An abnormal image object causes the renderer to enter the wrong processing branch. When converting the scan lines, an invalid image buffer pointer is used, res… |
CVE-2026-57243 | Medium | 6.1 | 2026-07-08 | During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, with outdated page in… |
CVE-2026-57241 | Medium | 6.1 | 2026-07-08 | The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the application to lose… |
CVE-2026-50811 | Medium | 6.5 | 2026-07-07 | An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in… |
CVE-2026-14740 | Critical | 9.1 | 2026-07-07 | DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and remove… |
CVE-2026-58469 | High | 7.5 | 2026-07-07 | GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c… |
CVE-2026-38973 | Medium | 4.4 | 2026-07-06 | mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc_find_method(). |
CVE-2026-13705 | High | 7.1 | 2026-07-06 | Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. … |
CVE-2026-10657 | Low | 3.7 | 2026-07-05 | Zephyr's DNS resolver detects mDNS (.local) queries in dns_resolve_name_internal() (subsys/net/lib/dns/resolve.c) with memcmp(strrchr(query, '.'), ".local", 7)… |
CVE-2026-14647 | Medium | 4.3 | 2026-07-04 | A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of… |
CVE-2026-53360 | High | 8.8 | 2026-07-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when u… |
CVE-2026-56015 | Critical | 9.1 | 2026-07-03 | Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length. add() passes the prefix string to the trie builder… |
CVE-2026-38971 | Critical | 9.1 | 2026-07-02 | ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_co… |
CVE-2026-14422 | High | 8.8 | 2026-07-01 | Out of bounds read and write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2026-14420 | Critical | 9.6 | 2026-07-01 | Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HT… |
CVE-2026-14416 | Critical | 9.6 | 2026-07-01 | Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (… |
CVE-2026-14406 | Medium | 5.9 | 2026-07-01 | Out of bounds read in V8 in Google Chrome prior to 150.0.7871.46 allowed an attacker who convinced a user to install a malicious extension to obtain potentiall… |
CVE-2026-14396 | Medium | 6.5 | 2026-07-01 | Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secu… |
CVE-2026-14388 | Medium | 6.5 | 2026-07-01 | Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2026-14386 | Medium | 6.5 | 2026-07-01 | Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2026-14384 | Medium | 6.5 | 2026-07-01 | Out of bounds read in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-54908 | | 2026-07-01 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsi… | |
CVE-2025-15646 | Critical | 9.8 | 2026-07-01 | HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, bu… |
CVE-2026-53346 | High | 7.1 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES Due to a rustc bug [1]… |
CVE-2026-53330 | High | 7.1 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() [Why & How] The au… |
CVE-2026-44041 | Medium | 4.3 | 2026-07-01 | UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb() function passes a… |
CVE-2026-54592 | High | 7.5 | 2026-07-01 | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child, when invoked recursively ov… |
CVE-2026-54500 | Medium | 5.3 | 2026-07-01 | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized sta… |
CVE-2026-56361 | Low | 3.3 | 2026-06-30 | ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer o… |
CVE-2026-14090 | High | 8.1 | 2026-06-30 | Insufficient validation of untrusted input in CameraCapture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to perform an out of… |
CVE-2026-14063 | Medium | 5.7 | 2026-06-30 | Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memo… |
CVE-2026-14011 | High | 8.1 | 2026-06-30 | Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory read via a crafted HT… |
CVE-2026-13975 | Medium | 5.3 | 2026-06-30 | Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potenti… |
CVE-2026-13906 | Medium | 6.5 | 2026-06-30 | Out of bounds read in Codecs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-13890 | Medium | 5.3 | 2026-06-30 | Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potential… |
CVE-2026-13873 | Medium | 6.5 | 2026-06-30 | Out of bounds read in Layout in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-13858 | Medium | 6.5 | 2026-06-30 | Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-13820 | Medium | 6.5 | 2026-06-30 | Out of bounds read in Skia in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-orig… |
CVE-2026-13819 | High | 8.1 | 2026-06-30 | Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform an out… |
CVE-2026-9263 | Medium | 6.5 | 2026-06-30 | The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fails to validate the length field of a framed ISO PDU start s… |
CVE-2026-10652 | Medium | 4.8 | 2026-06-30 | Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from DNS responses in dns_unpack_answer(), which validated only the fixed RR header (type, c… |
CVE-2026-8451 | High | 7.5 | 2026-06-30 | Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML I… |
CVE-2026-58011 | Medium | 6.5 | 2026-06-30 | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDat… |
CVE-2026-10817 | High | 7.5 | 2026-06-30 | Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP TimeStamp is enabled in TCP Profile and is associate… |
CVE-2026-56017 | High | 7.5 | 2026-06-29 | JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The rege… |
CVE-2026-43712 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visio… |
CVE-2026-43703 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Ta… |
CVE-2026-43676 | Medium | 6.5 | 2026-06-29 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-28979 | Medium | 6.5 | 2026-06-29 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-9267 | | 2026-06-29 | Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in the check_server_certificate() function… | |
CVE-2026-13522 | Medium | 4.3 | 2026-06-29 | A security flaw has been discovered in Investintech SlimPDFReader up to 2.0.14. Affected by this issue is the function SlimPDFReader!Investintech::PCV::TeighaD… |
CVE-2026-45258 | High | 7.8 | 2026-06-27 | dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could over… |
CVE-2026-48770 | Medium | 5.0 | 2026-06-26 | Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYD… |
CVE-2026-53303 | High | 7.1 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() In f2fs_sbi_show()… |
CVE-2026-54341 | High | 7.5 | 2026-06-26 | Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in Drago… |
CVE-2026-5757 | High | 7.5 | 2026-06-26 | Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap m… |
CVE-2026-12340 | High | 7.5 | 2026-06-25 | Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier com… |
CVE-2026-56788 | Medium | 4.4 | 2026-06-25 | RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attacke… |
CVE-2026-12897 | | 2026-06-25 | Horner Automation Cscape versions prior to 10.2 SP3 are vulnerable to an Out-of-Bounds Read vulnerability through parsing CSP files. Successful exploitation of… | |
CVE-2026-6094 | Critical | 9.1 | 2026-06-25 | Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data… |
CVE-2026-57454 | Medium | 6.1 | 2026-06-25 | Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and l… |
CVE-2026-57452 | Medium | 5.5 | 2026-06-25 | Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly… |
CVE-2026-57451 | Medium | 5.3 | 2026-06-25 | Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line… |
CVE-2026-57235 | High | 8.2 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked th… |
CVE-2026-4526 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These mess… |
CVE-2026-47154 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the proc… |
CVE-2026-47149 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These me… |
CVE-2026-47148 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process… |
CVE-2026-47147 | High | 7.1 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read bac… |
CVE-2026-53268 | High | 8.2 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've… |
CVE-2026-53255 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlv_data_is_valid() reads ea… |
CVE-2026-53254 | High | 8.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->… |
CVE-2026-53253 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU… |
CVE-2026-53230 | High | 8.7 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list mlx5_query_nic_vport_ma… |
CVE-2026-53224 | Critical | 9.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie(… |
CVE-2026-53179 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix buffer over-read in rtw_update_protection rtw_update_protection()… |
CVE-2026-53172 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix IFM region index out-of-bounds in command stream parser NPU_SET_IFM_REG… |
CVE-2026-53149 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does no… |
CVE-2026-53147 | High | 8.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request(… |
CVE-2026-53138 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS record-chain walk loops [Why & How] All record-chain walk lo… |
CVE-2026-13033 | High | 8.8 | 2026-06-24 | Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted… |
CVE-2026-53078 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops When a BPF sock_ops… |
CVE-2026-53076 | High | 7.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix OOB in pcpu_init_value An out-of-bounds read occurs when copying element from a … |