CWE-125 · Out-of-bounds Read (page 15)
Page 15 of 99 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-31568 | High | 7.1 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: s390/mm: Add missing secure storage access fixups for donated memory There are special ca… |
CVE-2026-31558 | High | 8.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust kvm_get_vcpu_by_cpuid() takes a… |
CVE-2026-33317 | High | 8.7 | 2026-04-24 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technolog… |
CVE-2026-28525 | Medium | 6.8 | 2026-04-23 | SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a de… |
CVE-2026-6920 | Critical | 9.6 | 2026-04-23 | Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-34003 | High | 7.8 | 2026-04-23 | A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to… |
CVE-2026-33599 | Low | 3.1 | 2026-04-22 | A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newS… |
CVE-2026-33598 | Medium | 4.8 | 2026-04-22 | A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache. |
CVE-2026-31528 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: perf: Make sure to use pmu_ctx->pmu for groups Oliver reported that x86_pmu_del() ended u… |
CVE-2026-31513 | High | 8.1 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req Syzbot reported a… |
CVE-2026-31484 | High | 7.1 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check __io_uring_show_fdinfo() iterates o… |
CVE-2026-31464 | High | 8.1 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() A malicious or compromised… |
CVE-2026-31449 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_correct_indexes() walks… |
CVE-2026-31442 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix possible invalid memory access after FLR In the case that the first… |
CVE-2026-31435 | High | 8.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix read abandonment during retry Under certain circumstances, all the remaining s… |
CVE-2026-31433 | High | 8.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial OOB in get_file_all_info() for compound requests When a compound req… |
CVE-2026-40890 | High | 7.5 | 2026-04-21 | The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < chara… |
CVE-2026-24189 | High | 8.2 | 2026-04-21 | NVIDIA CUDA-Q contains a vulnerability in an endpoint, where an unauthenticated attacker could cause an out-of-bounds read by sending a maliciously crafted req… |
CVE-2026-6784 | High | 7.5 | 2026-04-21 | Memory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-0930 | Medium | 4.3 | 2026-04-20 | Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read… |
CVE-2026-31430 | High | 7.1 | 2026-04-20 | In the Linux kernel, the following vulnerability has been resolved: X.509: Fix out-of-bounds access when parsing extensions Leo reports an out-of-bounds acce… |
CVE-2026-40340 | Medium | 6.1 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read vulnerability in `ptp_unpack_OI()` in `camlib… |
CVE-2026-40339 | Medium | 5.2 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/p… |
CVE-2026-40338 | Medium | 5.2 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpa… |
CVE-2026-40335 | Medium | 5.2 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_DPV()` in `camlibs/ptp2/ptp-pa… |
CVE-2026-40333 | Medium | 6.1 | 2026-04-18 | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but n… |
CVE-2026-5720 | Critical | 9.1 | 2026-04-17 | miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information dis… |
CVE-2026-29013 | Critical | 9.8 | 2026-04-17 | libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely… |
CVE-2026-33689 | Critical | 9.1 | 2026-04-17 | xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remo… |
CVE-2026-33516 | Critical | 9.1 | 2026-04-17 | xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue occu… |
CVE-2026-40253 | Medium | 6.8 | 2026-04-16 | openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common lib… |
CVE-2026-41034 | Medium | 5.0 | 2026-04-16 | ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leadin… |
CVE-2026-6364 | Medium | 6.5 | 2026-04-15 | Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2026-6308 | High | 7.5 | 2026-04-15 | Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execut… |
CVE-2026-40917 | Medium | 5.0 | 2026-04-15 | A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image files… |
CVE-2026-27294 | High | 7.8 | 2026-04-14 | Adobe Framemaker versions 2022.8 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past… |
CVE-2026-33019 | High | 7.1 | 2026-04-14 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow leading to an out-of-bounds… |
CVE-2026-27287 | High | 7.8 | 2026-04-14 | InCopy versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-27289 | High | 7.8 | 2026-04-14 | Photoshop Desktop versions 27.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past… |
CVE-2026-33822 | Medium | 6.1 | 2026-04-14 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-33096 | High | 7.5 | 2026-04-14 | Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. |
CVE-2026-32188 | High | 7.1 | 2026-04-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-32076 | High | 7.8 | 2026-04-14 | Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
CVE-2026-27931 | Medium | 5.5 | 2026-04-14 | Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. |
CVE-2026-27930 | Medium | 5.5 | 2026-04-14 | Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. |
CVE-2026-26156 | High | 7.8 | 2026-04-14 | Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally. |
CVE-2026-26153 | High | 7.8 | 2026-04-14 | Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-27284 | High | 7.8 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a rea… |
CVE-2026-5713 | | 2026-04-14 | The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features… | |
CVE-2026-39979 | Medium | 6.5 | 2026-04-13 | jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer wit… |
CVE-2026-39956 | Medium | 6.1 | 2026-04-13 | jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes()… |
CVE-2026-33905 | Medium | 5.5 | 2026-04-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the -sample opera… |
CVE-2026-32605 | High | 7.5 | 2026-04-13 | nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an un… |
CVE-2026-30997 | High | 7.5 | 2026-04-13 | An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a craf… |
CVE-2026-25209 | Medium | 6.5 | 2026-04-13 | Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a7152… |
CVE-2026-25206 | Medium | 6.7 | 2026-04-13 | Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a7152… |
CVE-2026-31413 | High | 7.8 | 2026-04-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR maybe_fork_scalars() i… |
CVE-2026-5393 | Critical | 9.1 | 2026-04-10 | Dual-Algorithm CertificateVerify out-of-bounds read. When processing a dual-algorithm CertificateVerify message, an out-of-bounds read can occur on crafted inp… |
CVE-2026-5392 | Medium | 5.4 | 2026-04-10 | Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 message can trigger an OOB read on the heap. The missing bounds check is in the indefinite-length end… |
CVE-2026-34987 | Critical | 9.9 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may al… |
CVE-2026-34971 | High | 7.8 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 whe… |
CVE-2026-34941 | High | 8.1 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to… |
CVE-2026-39856 | Medium | 5.5 | 2026-04-09 | osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version… |
CVE-2026-39855 | Medium | 5.5 | 2026-04-09 | osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version… |
CVE-2026-5445 | Critical | 9.1 | 2026-04-09 | An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETT… |
CVE-2026-5441 | High | 7.1 | 2026-04-09 | An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes… |
CVE-2026-5437 | High | 7.5 | 2026-04-09 | An out-of-bounds read vulnerability exists in `DicomStreamReader` during DICOM meta-header parsing. When processing malformed metadata structures, the parser m… |
CVE-2026-5913 | High | 8.1 | 2026-04-08 | Out of bounds read in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2026-5907 | High | 8.1 | 2026-04-08 | Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted v… |
CVE-2026-5886 | Medium | 5.3 | 2026-04-08 | Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2026-5873 | High | 8.8 | 2026-04-08 | Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-40026 | Medium | 4.4 | 2026-04-08 | The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_… |
CVE-2026-40025 | Medium | 4.4 | 2026-04-08 | The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows atta… |
CVE-2026-39864 | Medium | 4.4 | 2026-04-08 | Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.0.5 and 5.8.7, an out-of-bounds read in the auth module of Kamailio (formerly O… |
CVE-2026-28386 | High | 7.5 | 2026-04-07 | Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 by… |
CVE-2026-32864 | High | 7.8 | 2026-04-07 | There is a memory corruption vulnerability due to an out-of-bounds read in mgcore_SH_25_3!aligned_free() in NI LabVIEW. This vulnerability may result in infor… |
CVE-2026-32863 | High | 7.8 | 2026-04-07 | There is a memory corruption vulnerability due to an out-of-bounds read in sentry_transaction_context_set_operation() in NI LabVIEW. This vulnerability may re… |
CVE-2026-5735 | Critical | 9.8 | 2026-04-07 | Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough… |
CVE-2026-35444 | High | 7.1 | 2026-04-06 | SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data… |
CVE-2026-35203 | High | 7.5 | 2026-04-06 | ZLMediaKit is a streaming media service framework. the VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload based on flag… |
CVE-2026-35201 | Medium | 5.9 | 2026-04-06 | Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-b… |
CVE-2026-35176 | High | 7.1 | 2026-04-06 | openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in POFParser::parseSection() that all… |
CVE-2026-35170 | High | 7.1 | 2026-04-06 | openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in BitParser::parseHeader() that allo… |
CVE-2026-34588 | High | 7.8 | 2026-04-06 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to… |
CVE-2026-5673 | Medium | 5.6 | 2026-04-06 | A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_… |
CVE-2026-31405 | Critical | 9.8 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handl… |
CVE-2026-34776 | Medium | 5.3 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, o… |
CVE-2026-34824 | High | 7.5 | 2026-04-03 | Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumpt… |
CVE-2026-31395 | High | 7.1 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler The ASYNC_EVENT_CMPL_EVEN… |
CVE-2026-31393 | High | 8.1 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access l2cap_information_… |
CVE-2026-23456 | High | 8.2 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case In decode_int(), the… |
CVE-2026-23455 | Critical | 9.1 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the… |
CVE-2026-28815 | High | 7.5 | 2026-04-03 | A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or… |
CVE-2025-43210 | Medium | 6.3 | 2026-04-02 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6… |
CVE-2026-34608 | Medium | 4.9 | 2026-04-02 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inproc.c, the hook_work_cb() function proce… |
CVE-2026-35038 | Medium | 6.5 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `… |
CVE-2026-34876 | High | 7.5 | 2026-04-02 | An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain a… |
CVE-2026-5342 | Medium | 5.3 | 2026-04-02 | A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decoders_libraw.cpp of th… |
CVE-2026-5315 | Medium | 4.3 | 2026-04-02 | A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component… |
CVE-2026-5314 | Medium | 4.3 | 2026-04-01 | A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the component TTF File… |