CWE-125 · Out-of-bounds Read (page 10)
Page 10 of 94 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-31413 | High | 7.8 | 2026-04-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR maybe_fork_scalars() i… |
CVE-2026-5393 | Critical | 9.1 | 2026-04-10 | Dual-Algorithm CertificateVerify out-of-bounds read. When processing a dual-algorithm CertificateVerify message, an out-of-bounds read can occur on crafted inp… |
CVE-2026-5392 | Medium | 5.4 | 2026-04-10 | Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 message can trigger an OOB read on the heap. The missing bounds check is in the indefinite-length end… |
CVE-2026-34987 | Critical | 9.9 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may al… |
CVE-2026-34971 | High | 7.8 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 whe… |
CVE-2026-34941 | High | 8.1 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to… |
CVE-2026-39856 | Medium | 5.5 | 2026-04-09 | osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version… |
CVE-2026-39855 | Medium | 5.5 | 2026-04-09 | osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version… |
CVE-2026-5445 | Critical | 9.1 | 2026-04-09 | An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETT… |
CVE-2026-5441 | High | 7.1 | 2026-04-09 | An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes… |
CVE-2026-5437 | High | 7.5 | 2026-04-09 | An out-of-bounds read vulnerability exists in `DicomStreamReader` during DICOM meta-header parsing. When processing malformed metadata structures, the parser m… |
CVE-2026-5913 | High | 8.1 | 2026-04-08 | Out of bounds read in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2026-5907 | High | 8.1 | 2026-04-08 | Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted v… |
CVE-2026-5886 | Medium | 5.3 | 2026-04-08 | Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2026-5873 | High | 8.8 | 2026-04-08 | Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-40026 | Medium | 4.4 | 2026-04-08 | The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_… |
CVE-2026-40025 | Medium | 4.4 | 2026-04-08 | The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows atta… |
CVE-2026-39864 | Medium | 4.4 | 2026-04-08 | Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.0.5 and 5.8.7, an out-of-bounds read in the auth module of Kamailio (formerly O… |
CVE-2026-28386 | High | 7.5 | 2026-04-07 | Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 by… |
CVE-2026-32864 | High | 7.8 | 2026-04-07 | There is a memory corruption vulnerability due to an out-of-bounds read in mgcore_SH_25_3!aligned_free() in NI LabVIEW. This vulnerability may result in infor… |
CVE-2026-32863 | High | 7.8 | 2026-04-07 | There is a memory corruption vulnerability due to an out-of-bounds read in sentry_transaction_context_set_operation() in NI LabVIEW. This vulnerability may re… |
CVE-2026-5735 | Critical | 9.8 | 2026-04-07 | Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough… |
CVE-2026-35444 | High | 7.1 | 2026-04-06 | SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data… |
CVE-2026-35203 | High | 7.5 | 2026-04-06 | ZLMediaKit is a streaming media service framework. the VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload based on flag… |
CVE-2026-35201 | Medium | 5.9 | 2026-04-06 | Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-b… |
CVE-2026-35176 | High | 7.1 | 2026-04-06 | openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in POFParser::parseSection() that all… |
CVE-2026-35170 | High | 7.1 | 2026-04-06 | openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in BitParser::parseHeader() that allo… |
CVE-2026-34588 | High | 7.8 | 2026-04-06 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to… |
CVE-2026-5673 | Medium | 5.6 | 2026-04-06 | A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_… |
CVE-2026-31405 | Critical | 9.8 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handl… |
CVE-2026-34776 | Medium | 5.3 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, o… |
CVE-2026-34824 | High | 7.5 | 2026-04-03 | Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumpt… |
CVE-2026-31395 | High | 7.1 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler The ASYNC_EVENT_CMPL_EVEN… |
CVE-2026-31393 | High | 8.1 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access l2cap_information_… |
CVE-2026-23456 | High | 8.2 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case In decode_int(), the… |
CVE-2026-23455 | Critical | 9.1 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the… |
CVE-2026-28815 | High | 7.5 | 2026-04-03 | A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or… |
CVE-2025-43210 | Medium | 6.3 | 2026-04-02 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6… |
CVE-2026-34608 | Medium | 4.9 | 2026-04-02 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inproc.c, the hook_work_cb() function proce… |
CVE-2026-35038 | Medium | 6.5 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `… |
CVE-2026-34876 | High | 7.5 | 2026-04-02 | An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain a… |
CVE-2026-5342 | Medium | 5.3 | 2026-04-02 | A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decoders_libraw.cpp of th… |
CVE-2026-5315 | Medium | 4.3 | 2026-04-02 | A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component… |
CVE-2026-5314 | Medium | 4.3 | 2026-04-01 | A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the component TTF File… |
CVE-2026-32929 | High | 7.8 | 2026-04-01 | V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!get_macro_mem_COM. Opening a crafted V7 file may lead to information disclosure f… |
CVE-2026-32927 | High | 7.8 | 2026-04-01 | V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to inform… |
CVE-2026-32926 | High | 7.8 | 2026-04-01 | V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf. Opening a crafted V7 file may lead to information di… |
CVE-2026-23407 | High | 7.8 | 2026-04-01 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds check on DEFAULT table in verify_dfa() The verify_dfa() func… |
CVE-2026-23406 | High | 7.8 | 2026-04-01 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix side-effect bug in match_char() macro usage The match_char() macro evaluate… |
CVE-2026-5292 | High | 8.8 | 2026-04-01 | Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML p… |
CVE-2026-5282 | High | 8.1 | 2026-04-01 | Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML p… |
CVE-2026-2394 | Medium | 6.5 | 2026-04-01 | Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.This issue affects Connext Professional: from 7.4.0 before… |
CVE-2026-34556 | Medium | 6.2 | 2026-03-31 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow (HBO) in… |
CVE-2026-34554 | Medium | 6.2 | 2026-03-31 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a heap-buffer-overflow (HBO) in CIccAppl… |
CVE-2026-34235 | Critical | 9.1 | 2026-03-31 | PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-bounds read vulnerability exists in PJSIP's… |
CVE-2026-33985 | Medium | 5.9 | 2026-03-30 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potential… |
CVE-2026-33982 | High | 7.1 | 2026-03-30 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflow READ vulnerability at 24 bytes before… |
CVE-2026-32877 | High | 8.2 | 2026-03-30 | Botan is a C++ cryptography library. From version 2.3.0 to before version 3.11.0, during SM2 decryption, the code that checked the authentication code value (C… |
CVE-2026-25627 | Medium | 6.5 | 2026-03-30 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be crashed by sending… |
CVE-2025-66037 | Low | 3.9 | 2026-03-30 | OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to p… |
CVE-2026-28528 | Medium | 4.6 | 2026-03-30 | BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Browsing Target GET_FOLDER_ITEMS handler that fails to val… |
CVE-2026-28527 | Low | 3.5 | 2026-03-30 | BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT a… |
CVE-2026-28526 | Low | 3.5 | 2026-03-30 | BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and… |
CVE-2026-32984 | Low | 3.5 | 2026-03-27 | Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted… |
CVE-2023-7340 | Low | 3.5 | 2026-03-27 | Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted… |
CVE-2026-27880 | High | 7.5 | 2026-03-27 | The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. |
CVE-2026-33669 | Critical | 9.8 | 2026-03-26 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/bl… |
CVE-2026-3622 | High | 7.5 | 2026-03-26 | The vulnerability exists in the UPnP component of TL-WR841N v14, where improper input validation leads to an out-of-bounds read, potentially causing a crash of… |
CVE-2026-32284 | High | 7.5 | 2026-03-26 | The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-… |
CVE-2026-33636 | High | 7.6 | 2026-03-26 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36… |
CVE-2026-26008 | High | 7.5 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have an out-of-bounds access (std::vector) that leads to possible remote crash/memory cor… |
CVE-2026-23397 | High | 7.1 | 2026-03-26 | In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnl_osf_add_callback()… |
CVE-2026-33515 | Medium | 6.5 | 2026-03-26 | Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traff… |
CVE-2026-23388 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: Squashfs: check metadata block offset is within range Syzkaller reports a "general protec… |
CVE-2026-23363 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() Check frame… |
CVE-2026-23327 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed… |
CVE-2026-23325 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() Check frame… |
CVE-2026-23318 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validato… |
CVE-2026-23315 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() Check frame le… |
CVE-2026-23305 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix unwinding in error path in rocket_probe When rocket_core_init() fails (… |
CVE-2026-23288 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix out-of-bounds memset in command slot handling The remaining space in a… |
CVE-2026-28890 | Medium | 5.5 | 2026-03-25 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able to cause unexpected system termination. |
CVE-2026-28859 | Medium | 4.3 | 2026-03-25 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4… |
CVE-2026-28857 | Medium | 6.5 | 2026-03-25 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processin… |
CVE-2026-28832 | High | 8.4 | 2026-03-25 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app m… |
CVE-2026-20690 | Medium | 6.5 | 2026-03-25 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS… |
CVE-2026-20657 | Medium | 6.5 | 2026-03-25 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequo… |
CVE-2026-32853 | High | 8.1 | 2026-03-24 | LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a… |
CVE-2026-32647 | High | 7.8 | 2026-03-24 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-wr… |
CVE-2026-4753 | Critical | 9.1 | 2026-03-24 | Out-of-bounds Read vulnerability in slajerek RetroDebugger.This issue affects RetroDebugger: before v0.64.72. |
CVE-2026-4750 | Critical | 9.1 | 2026-03-24 | Out-of-bounds Read vulnerability in fabiangreffrath woof.This issue affects woof: before woof_15.3.0. |
CVE-2026-4744 | | 2026-03-24 | Out-of-bounds Read vulnerability in rizonesoft Notepad3 (scintilla/oniguruma/src modules). This vulnerability is associated with program files regcomp.C. Th… | |
CVE-2026-4732 | | 2026-03-24 | Out-of-bounds Read vulnerability in tildearrow furnace (extern/libsndfile-modified/src modules). This vulnerability is associated with program files flac.C. … | |
CVE-2026-4677 | High | 8.8 | 2026-03-24 | Inappropriate implementation in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory read via a craft… |
CVE-2026-4674 | High | 8.8 | 2026-03-24 | Out of bounds read in CSS in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (C… |
CVE-2026-1940 | Medium | 5.1 | 2026-03-23 | An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > si… |
CVE-2026-3055 | Critical | 9.8 | 2026-03-23 | Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread |
CVE-2026-4647 | Medium | 6.1 | 2026-03-23 | A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when… |
CVE-2026-4437 | High | 7.5 | 2026-03-20 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version… |
CVE-2026-33069 | High | 7.5 | 2026-03-20 | PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsip_multip… |