CWE-125 · Out-of-bounds Read (page 14)
Page 14 of 99 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8213 | Medium | 5.3 | 2026-05-09 | A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of th… |
CVE-2026-8212 | Medium | 5.3 | 2026-05-09 | A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Execu… |
CVE-2026-8186 | Medium | 5.3 | 2026-05-09 | A vulnerability was detected in Open5GS up to 2.7.7. This affects the function ogs_sbi_client_send_via_scp_or_sepp in the library lib/sbi/client.c of the compo… |
CVE-2026-43453 | High | 7.1 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() pipapo_drop() pa… |
CVE-2026-43450 | High | 7.1 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_d… |
CVE-2026-43449 | High | 7.1 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set dev->online_queues is a count incremen… |
CVE-2026-43427 | High | 7.1 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: usb: class: cdc-wdm: fix reordering issue in read code path Quoting the bug report: Due… |
CVE-2026-43407 | Critical | 9.1 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes… |
CVE-2026-43406 | Critical | 9.1 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in process_message_header() If the message… |
CVE-2026-43386 | High | 7.1 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie The current c… |
CVE-2026-43380 | High | 7.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read The q54sj108a2_debugfs_read… |
CVE-2026-3508 | | 2026-05-08 | An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) via a read size that… | |
CVE-2026-8088 | Low | 3.3 | 2026-05-07 | A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Execut… |
CVE-2026-8084 | Low | 3.3 | 2026-05-07 | A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the c… |
CVE-2026-8092 | High | 8.1 | 2026-05-07 | Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we pr… |
CVE-2026-42216 | Critical | 9.1 | 2026-05-07 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions… |
CVE-2026-7995 | High | 8.8 | 2026-05-06 | Out of bounds read in AdFilter in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… |
CVE-2026-7983 | Medium | 4.3 | 2026-05-06 | Out of bounds read in Dawn in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-7981 | High | 8.1 | 2026-05-06 | Out of bounds read in Codecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-7950 | Medium | 5.4 | 2026-05-06 | Out of bounds read and write in GFX in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform arbitrary read/write via malicious network tra… |
CVE-2026-7949 | Low | 3.1 | 2026-05-06 | Out of bounds read in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-7933 | Medium | 4.3 | 2026-05-06 | Out of bounds read in WebCodecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform an out of bounds memory read via a crafted video f… |
CVE-2026-7904 | Medium | 4.3 | 2026-05-06 | Out of bounds read in Fonts in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2026-7902 | High | 8.8 | 2026-05-06 | Out of bounds memory access in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT… |
CVE-2026-7899 | High | 8.8 | 2026-05-06 | Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-43281 | High | 7.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that… |
CVE-2026-43280 | High | 7.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise When user pro… |
CVE-2026-43274 | High | 8.4 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq() The cl… |
CVE-2026-43256 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() vfe_isr() itera… |
CVE-2026-43241 | High | 7.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access Number of MW LUTs depends on… |
CVE-2026-43233 | High | 8.2 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the bou… |
CVE-2026-43197 | Critical | 9.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the… |
CVE-2026-43190 | High | 8.2 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In… |
CVE-2026-43141 | High | 7.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut Number of MW LUTs depends on… |
CVE-2026-43112 | High | 8.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath… |
CVE-2026-43083 | Critical | 9.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.b… |
CVE-2026-30923 | High | 7.5 | 2026-05-05 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecuri… |
CVE-2026-43071 | Critical | 9.1 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB read problem on dentry_… |
CVE-2026-43070 | High | 7.8 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register ID for BPF_END value tracking When a register undergoes a BPF_END (by… |
CVE-2026-34000 | Medium | 6.1 | 2026-05-05 | A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `Xkb… |
CVE-2026-6918 | High | 7.5 | 2026-05-05 | In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message. |
CVE-2026-37461 | High | 7.5 | 2026-05-04 | An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafte… |
CVE-2025-47406 | Medium | 6.1 | 2026-05-04 | Information Disclosure while processing IOCTL handler callbacks without verifying buffer size. |
CVE-2025-47403 | Medium | 6.5 | 2026-05-04 | Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming. |
CVE-2025-47401 | Medium | 6.5 | 2026-05-04 | Transient DOS when processing target power rate tables during channel configuration. |
CVE-2025-70072 | Medium | 6.5 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMaterial() components |
CVE-2026-34032 | Medium | 5.3 | 2026-05-04 | Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommend… |
CVE-2026-33857 | Medium | 5.3 | 2026-05-04 | Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to up… |
CVE-2026-7482 | Critical | 9.1 | 2026-05-04 | Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file… |
CVE-2026-7737 | Medium | 5.3 | 2026-05-04 | A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody… |
CVE-2026-20447 | Medium | 6.7 | 2026-05-04 | In geniezone, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor… |
CVE-2026-7668 | High | 7.3 | 2026-05-02 | A vulnerability was identified in MikroTik RouterOS 6.49.8. This vulnerability affects the function ASN1_STRING_data in the library nova/lib/www/scep.p of the… |
CVE-2026-35233 | Medium | 4.4 | 2026-05-01 | An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches t… |
CVE-2026-37535 | High | 7.1 | 2026-05-01 | openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, whe… |
CVE-2026-42481 | Medium | 5.5 | 2026-05-01 | Open CASCADE Technology (OCCT) V8_0_0_rc5 contains multiple vulnerabilities in its IGES and STEP file parsers that can be triggered by crafted IGES or STEP fil… |
CVE-2026-42480 | Medium | 5.5 | 2026-05-01 | A stack-based out-of-bounds read vulnerability in VrmlData_Scene::ReadLine in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to… |
CVE-2026-43051 | High | 8.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() funct… |
CVE-2026-43048 | High | 8.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: HID: core: Mitigate potential OOB by removing bogus memset() The memset() in hid_report_r… |
CVE-2026-43042 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platform_label{,s} pair The RCU-protected codepaths (mp… |
CVE-2026-43025 | High | 7.3 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Use the existing master… |
CVE-2026-43006 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: reject zero-length fixed buffer import validate_fixed_range() admits buf_a… |
CVE-2026-43005 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (tps53679) Fix array access with zero-length block read i2c_smbus_read_block_data(… |
CVE-2026-42479 | Medium | 5.5 | 2026-05-01 | An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to caus… |
CVE-2026-42478 | High | 7.5 | 2026-05-01 | An issue was discovered in VrmlData_IndexedFaceSet::TShape in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a den… |
CVE-2026-42477 | High | 7.1 | 2026-05-01 | A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows user-assisted at… |
CVE-2026-42476 | High | 7.1 | 2026-05-01 | Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii be… |
CVE-2026-31782 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: perf/x86: Fix potential bad container_of in intel_pmu_hw_config Auto counter reload may h… |
CVE-2026-31779 | High | 8.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() T… |
CVE-2026-31778 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix stack out-of-bounds read in init_card The loop creates a whitespace-stri… |
CVE-2026-31774 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() sqe->len is __u32 but gets… |
CVE-2026-31742 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: vt: discard stale unicode buffer on alt screen exit after resize When enter_alt_screen()… |
CVE-2026-31708 | High | 8.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path smb2_ioctl_query_info(… |
CVE-2026-40686 | Low | 3.7 | 2026-04-30 | In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header d… |
CVE-2026-33451 | High | 7.8 | 2026-04-30 | CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows clien… |
CVE-2026-33450 | Medium | 5.5 | 2026-04-30 | CVE-2026-33450 is an out of bounds read vulnerability in the Secure Access MacOS client prior to 14.50. Attackers with control of a modified server can send… |
CVE-2026-28532 | Medium | 6.5 | 2026-04-30 | FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t… |
CVE-2026-42799 | High | 7.4 | 2026-04-30 | Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers. This vulnerability is associated with program files Code/Nr/nr_fw/RA… |
CVE-2026-7425 | Medium | 6.5 | 2026-04-29 | Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to… |
CVE-2026-2810 | | 2026-04-29 | Netskope was notified about a potential gap in the Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can poten… | |
CVE-2026-7354 | High | 8.8 | 2026-04-28 | Out of bounds read and write in Angle in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
CVE-2026-7320 | High | 7.5 | 2026-04-28 | Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1… |
CVE-2026-41607 | Medium | 6.5 | 2026-04-28 | Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which… |
CVE-2026-41604 | High | 8.2 | 2026-04-28 | Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which… |
CVE-2026-7233 | Low | 3.3 | 2026-04-28 | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the compo… |
CVE-2026-7135 | Medium | 5.3 | 2026-04-27 | A security flaw has been discovered in GPAC up to 26.03-DEV-rev105-g8f39a1eb3-master. Affected by this vulnerability is the function elng_box_read of the file… |
CVE-2026-6786 | High | 7.5 | 2026-04-26 | Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruptio… |
CVE-2026-6785 | High | 7.5 | 2026-04-26 | Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence… |
CVE-2026-31675 | High | 7.8 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_netem: fix out-of-bounds access in packet corruption In netem_enqueue(), t… |
CVE-2026-41503 | High | 7.5 | 2026-04-24 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's ReadP… |
CVE-2026-41502 | High | 7.5 | 2026-04-24 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an off-by-one out-of-bounds read vulnerability in bacnet-st… |
CVE-2026-41475 | Critical | 9.1 | 2026-04-24 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's Write… |
CVE-2026-41415 | Critical | 9.1 | 2026-04-24 | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Con… |
CVE-2026-41677 | Critical | 9.1 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the leng… |
CVE-2026-41079 | Medium | 4.3 | 2026-04-24 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a cr… |
CVE-2026-31641 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rxgk() reads the raw… |
CVE-2026-31636 | Critical | 9.1 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator() copies auth… |
CVE-2026-31614 | High | 7.1 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix off-by-8 bounds check in check_wsl_eas() The bounds check uses (u8 *)ea… |
CVE-2026-31613 | High | 8.1 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_ST… |
CVE-2026-31570 | High | 8.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: can: gw: fix OOB heap access in cgw_csum_crc8_rel() cgw_csum_crc8_rel() correctly compute… |
CVE-2026-31569 | High | 7.3 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Handle the case that EIOINTC's coremap is empty EIOINTC's coremap in eioi… |