CWE-125 · Out-of-bounds Read (page 16)
Page 16 of 99 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32929 | High | 7.8 | 2026-04-01 | V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!get_macro_mem_COM. Opening a crafted V7 file may lead to information disclosure f… |
CVE-2026-32927 | High | 7.8 | 2026-04-01 | V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to inform… |
CVE-2026-32926 | High | 7.8 | 2026-04-01 | V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf. Opening a crafted V7 file may lead to information di… |
CVE-2026-23407 | High | 7.8 | 2026-04-01 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds check on DEFAULT table in verify_dfa() The verify_dfa() func… |
CVE-2026-23406 | High | 7.8 | 2026-04-01 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix side-effect bug in match_char() macro usage The match_char() macro evaluate… |
CVE-2026-5292 | High | 8.8 | 2026-04-01 | Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML p… |
CVE-2026-5282 | High | 8.1 | 2026-04-01 | Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML p… |
CVE-2026-2394 | Medium | 6.5 | 2026-04-01 | Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before… |
CVE-2026-34556 | Medium | 6.2 | 2026-03-31 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow (HBO) in… |
CVE-2026-34554 | Medium | 6.2 | 2026-03-31 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a heap-buffer-overflow (HBO) in CIccAppl… |
CVE-2026-34235 | Critical | 9.1 | 2026-03-31 | PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-bounds read vulnerability exists in PJSIP's… |
CVE-2026-33985 | Medium | 5.9 | 2026-03-30 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potential… |
CVE-2026-33982 | High | 7.1 | 2026-03-30 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflow READ vulnerability at 24 bytes before… |
CVE-2026-32877 | High | 8.2 | 2026-03-30 | Botan is a C++ cryptography library. From version 2.3.0 to before version 3.11.0, during SM2 decryption, the code that checked the authentication code value (C… |
CVE-2026-25627 | Medium | 6.5 | 2026-03-30 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be crashed by sending… |
CVE-2025-66037 | Low | 3.9 | 2026-03-30 | OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to p… |
CVE-2026-28528 | Medium | 4.6 | 2026-03-30 | BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Browsing Target GET_FOLDER_ITEMS handler that fails to val… |
CVE-2026-28527 | Low | 3.5 | 2026-03-30 | BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT a… |
CVE-2026-28526 | Low | 3.5 | 2026-03-30 | BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and… |
CVE-2026-32984 | Low | 3.5 | 2026-03-27 | Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted… |
CVE-2023-7340 | Low | 3.5 | 2026-03-27 | Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted… |
CVE-2026-27880 | High | 7.5 | 2026-03-27 | The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. |
CVE-2026-33669 | Critical | 9.8 | 2026-03-26 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/bl… |
CVE-2026-3622 | High | 7.5 | 2026-03-26 | The vulnerability exists in the UPnP component of TL-WR841N v14, where improper input validation leads to an out-of-bounds read, potentially causing a crash of… |
CVE-2026-32284 | High | 7.5 | 2026-03-26 | The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-… |
CVE-2026-33636 | High | 7.6 | 2026-03-26 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36… |
CVE-2026-26008 | High | 7.5 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have an out-of-bounds access (std::vector) that leads to possible remote crash/memory cor… |
CVE-2026-23397 | High | 7.1 | 2026-03-26 | In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnl_osf_add_callback()… |
CVE-2026-33515 | Medium | 6.5 | 2026-03-26 | Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traff… |
CVE-2026-23388 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: Squashfs: check metadata block offset is within range Syzkaller reports a "general protec… |
CVE-2026-23363 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() Check frame… |
CVE-2026-23327 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed… |
CVE-2026-23325 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() Check frame… |
CVE-2026-23318 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validato… |
CVE-2026-23315 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() Check frame le… |
CVE-2026-23305 | High | 7.1 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix unwinding in error path in rocket_probe When rocket_core_init() fails (… |
CVE-2026-23288 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix out-of-bounds memset in command slot handling The remaining space in a… |
CVE-2026-28890 | Medium | 5.5 | 2026-03-25 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able to cause unexpected system termination. |
CVE-2026-28859 | Medium | 4.3 | 2026-03-25 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4… |
CVE-2026-28857 | Medium | 6.5 | 2026-03-25 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processin… |
CVE-2026-28832 | High | 8.4 | 2026-03-25 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app m… |
CVE-2026-20690 | Medium | 6.5 | 2026-03-25 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS… |
CVE-2026-20657 | Medium | 6.5 | 2026-03-25 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequo… |
CVE-2026-32853 | High | 8.1 | 2026-03-24 | LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a… |
CVE-2026-32647 | High | 7.8 | 2026-03-24 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-wr… |
CVE-2026-4753 | Critical | 9.1 | 2026-03-24 | Out-of-bounds Read vulnerability in slajerek RetroDebugger.This issue affects RetroDebugger: before v0.64.72. |
CVE-2026-4750 | Critical | 9.1 | 2026-03-24 | Out-of-bounds Read vulnerability in fabiangreffrath woof.This issue affects woof: before woof_15.3.0. |
CVE-2026-4744 | | 2026-03-24 | Out-of-bounds Read vulnerability in rizonesoft Notepad3 (scintilla/oniguruma/src modules). This vulnerability is associated with program files regcomp.C. Th… | |
CVE-2026-4732 | | 2026-03-24 | Out-of-bounds Read vulnerability in tildearrow furnace (extern/libsndfile-modified/src modules). This vulnerability is associated with program files flac.C. … | |
CVE-2026-4677 | High | 8.8 | 2026-03-24 | Inappropriate implementation in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory read via a craft… |
CVE-2026-4674 | High | 8.8 | 2026-03-24 | Out of bounds read in CSS in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (C… |
CVE-2026-1940 | Medium | 5.1 | 2026-03-23 | An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > si… |
CVE-2026-3055 | Critical | 9.8 | 2026-03-23 | Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread |
CVE-2026-4647 | Medium | 6.1 | 2026-03-23 | A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when… |
CVE-2026-4437 | High | 7.5 | 2026-03-20 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version… |
CVE-2026-33069 | High | 7.5 | 2026-03-20 | PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsip_multip… |
CVE-2026-4462 | High | 8.8 | 2026-03-20 | Out of bounds read in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2026-4460 | High | 8.8 | 2026-03-20 | Out of bounds read in Skia in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2026-4459 | High | 8.8 | 2026-03-20 | Out of bounds read and write in WebAudio in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2026-4440 | High | 8.8 | 2026-03-20 | Out of bounds read and write in WebGL in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pag… |
CVE-2026-4439 | High | 8.8 | 2026-03-20 | Out of bounds memory access in WebGL in Google Chrome on Android prior to 146.0.7680.153 allowed a remote attacker to potentially perform a sandbox escape via… |
CVE-2026-4159 | Low | 3.3 | 2026-03-19 | 1-byte OOB heap read in wc_PKCS7_DecodeEnvelopedData via zero-length encrypted content. A vulnerability existed in wolfSSL 5.8.4 and earlier, where a 1-byte ou… |
CVE-2026-3547 | High | 7.5 | 2026-03-19 | Out-of-bounds read in ALPN parsing due to incomplete validation. wolfSSL 5.8.4 and earlier contained an out-of-bounds read in ALPN handling when built with ALP… |
CVE-2026-4424 | High | 7.5 | 2026-03-19 | A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sl… |
CVE-2026-31967 | Critical | 9.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_dec… |
CVE-2026-31966 | Critical | 9.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of… |
CVE-2026-31965 | High | 8.2 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_dec… |
CVE-2026-31962 | High | 8.8 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. While most align… |
CVE-2026-23269 | High | 7.1 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read fro… |
CVE-2026-23244 | High | 7.1 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: nvme: fix memory allocation in nvme_pr_read_keys() nvme_pr_read_keys() takes num_keys fro… |
CVE-2026-22882 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2026-20726 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66633 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66617 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66503 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66042 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-66000 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-65119 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-64776 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-64735 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-64733 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-62500 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-62403 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-61979 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-61952 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-58427 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2025-47873 | Medium | 6.1 | 2026-03-17 | An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vu… |
CVE-2026-0708 | High | 8.3 | 2026-03-17 | A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) input that contains a… |
CVE-2025-69693 | Medium | 5.4 | 2026-03-16 | Out-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder (libavcodec/rv60dec.c). The quantization parameter (qp) validation at line 2267 only checks the l… |
CVE-2025-69808 | Critical | 9.1 | 2026-03-16 | An out-of-bounds memory access (OOB) in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to access sensitive information and cause a Denial of Serv… |
CVE-2026-4227 | High | 8.8 | 2026-03-16 | A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. Th… |
CVE-2026-3442 | Medium | 6.1 | 2026-03-16 | A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An… |
CVE-2026-3441 | Medium | 6.1 | 2026-03-16 | A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to ga… |
CVE-2026-28521 | High | 7.7 | 2026-03-16 | arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuy… |
CVE-2025-71264 | Low | 3.7 | 2026-03-16 | Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash). |
CVE-2026-32320 | Medium | 6.5 | 2026-03-13 | Ella Core is a 5G core designed for private networks. Prior to 1.5.1, Ella Core panics when processing a PathSwitchRequest containing UE Security Capabilities… |
CVE-2026-32319 | High | 7.5 | 2026-03-13 | Ella Core is a 5G core designed for private networks. Prior to 1.5.1, Ella Core panics when processing a malformed integrity protected NGAP/NAS message with a… |
CVE-2026-31897 | Unrated | | 2026-03-13 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in freerdp_bitmap_decompress_planar when SrcSi… |
CVE-2026-31885 | Medium | 6.5 | 2026-03-13 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unch… |
CVE-2026-0956 | High | 7.8 | 2026-03-13 | There is a memory corruption vulnerability due to an out-of-bounds read when loading a corrupted file in Digilent DASYLab. This vulnerability may result in in… |