CWE-125 · Out-of-bounds Read (page 2)
Page 2 of 99 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-86930 | Critical | 9.1 | 2026-09-23 | An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose… |
CVE-2026-79616 | | 2026-09-23 | Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path. | |
CVE-2026-91817 | Medium | 6.1 | 2026-09-23 | A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation… |
CVE-2026-91810 | Medium | 6.1 | 2026-09-23 | A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause… |
CVE-2026-91808 | Medium | 6.1 | 2026-09-23 | A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insuffi… |
CVE-2026-91807 | Medium | 6.1 | 2026-09-23 | A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the so… |
CVE-2026-88345 | High | 7.5 | 2026-09-22 | An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema ends with an unterminated quotation… |
CVE-2026-77558 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Se… |
CVE-2026-77556 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Se… |
CVE-2026-75656 | Medium | 5.5 | 2026-09-22 | Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to d… |
CVE-2026-18626 | | 2026-09-22 | Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 befo… | |
CVE-2026-18458 | | 2026-09-22 | Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connex… | |
CVE-2026-11389 | | 2026-09-22 | Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connex… | |
CVE-2026-81884 | Low | 2.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because t… |
CVE-2026-81883 | Low | 3.3 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable becaus… |
CVE-2026-81882 | Low | 3.3 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable bec… |
CVE-2026-81881 | Low | 3.3 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable beca… |
CVE-2026-81879 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF pa… |
CVE-2026-63279 | | 2026-09-22 | LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The p… | |
CVE-2026-63274 | | 2026-09-22 | LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's… | |
CVE-2026-63272 | | 2026-09-22 | LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own chara… | |
CVE-2026-74765 | Medium | 6.5 | 2026-09-22 | Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. The XS backend… |
CVE-2026-17054 | Medium | 5.3 | 2026-09-21 | The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For cont… |
CVE-2026-57228 | High | 8.2 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME q… |
CVE-2026-75895 | High | 7.5 | 2026-09-18 | In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34_unpack() function via attacker controlled SMPP PDUs, leading to memory… |
CVE-2026-61721 | High | 8.0 | 2026-09-18 | FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loop_s… |
CVE-2026-61714 | High | 7.8 | 2026-09-18 | FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI… |
CVE-2026-11726 | High | 8.1 | 2026-09-18 | IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to imprope… |
CVE-2026-73863 | | 2026-09-18 | NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmq_subinfo_decode() function in nng/src/sp/protocol/mqtt/mqtt_parser.c reuses len_of_… | |
CVE-2026-84451 | Medium | 6.5 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_un… |
CVE-2026-84449 | Low | 3.7 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an intege… |
CVE-2026-84448 | Medium | 4.0 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/… |
CVE-2026-65969 | Medium | 5.5 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-63635 | Medium | 5.5 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-63420 | Medium | 5.5 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-59956 | Medium | 6.1 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0… |
CVE-2026-16514 | Medium | 4.3 | 2026-09-18 | gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock… |
CVE-2026-16512 | Low | 3.1 | 2026-09-18 | gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_type without first che… |
CVE-2026-93331 | High | 7.3 | 2026-09-18 | A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacketizer.c of the comp… |
CVE-2026-73638 | Medium | 6.2 | 2026-09-17 | Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd. tiff_load_ifd() validates an IFD… |
CVE-2026-54633 | | 2026-09-17 | PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-… | |
CVE-2026-50291 | Medium | 5.5 | 2026-09-17 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 an… |
CVE-2026-93376 | Medium | 6.3 | 2026-09-17 | Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allowed a local attacker leveraging social engineering to read memory outside the sa… |
CVE-2026-52836 | | 2026-09-17 | OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). Prior to 3.34.0, a network attacker can cras… | |
CVE-2026-44235 | Medium | 6.5 | 2026-09-17 | rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during clie… |
CVE-2026-54579 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the… | |
CVE-2026-92925 | High | 7.1 | 2026-09-17 | A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-ca… |
CVE-2026-25282 | High | 7.9 | 2026-09-17 | Transient DOS when processing unverified data from a neighboring system causes out of bound memory access. |
CVE-2026-92475 | Medium | 5.3 | 2026-09-16 | A weakness has been identified in GPAC 26.08-DEV. This impacts the function wait_for_header_and_parse of the file src/utils/downloader.c. This manipulation of… |
CVE-2026-73462 | Medium | 6.5 | 2026-09-16 | On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjace… |
CVE-2026-56719 | Medium | 6.5 | 2026-09-16 | MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the… |
CVE-2026-76151 | | 2026-09-16 | Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 t… | |
CVE-2026-73436 | Medium | 6.5 | 2026-09-16 | On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor ma… |
CVE-2026-92255 | Medium | 5.4 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. Att… |
CVE-2026-76870 | High | 7.1 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtd_write pre-flash validation routine triggered by short firmware uploa… |
CVE-2026-91726 | Medium | 4.7 | 2026-09-15 | Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HT… |
CVE-2026-92240 | Critical | 9.1 | 2026-09-15 | A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbi… |
CVE-2026-92239 | High | 8.1 | 2026-09-15 | A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderb… |
CVE-2026-92176 | High | 7.8 | 2026-09-15 | pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-58731 | Medium | 6.2 | 2026-09-15 | In multiple functions of physmem_extmem_linux.c, there is a possible out-of-bounds read due to uninitialized data. This could lead to local information disclos… |
CVE-2026-58699 | High | 8.4 | 2026-09-15 | In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local escalation of privi… |
CVE-2026-56978 | High | 8.4 | 2026-09-15 | In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local escalation of privilege… |
CVE-2026-56958 | Medium | 5.5 | 2026-09-15 | In gf_algo_get_cached_dump_data of gf_algo.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclo… |
CVE-2026-0177 | Medium | 4.4 | 2026-09-15 | In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure… |
CVE-2026-85234 | High | 7.5 | 2026-09-15 | A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can p… |
CVE-2026-91959 | Medium | 6.5 | 2026-09-15 | FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a m… |
CVE-2026-91958 | Medium | 6.6 | 2026-09-15 | FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xf_detect_monit… |
CVE-2026-91956 | Medium | 6.5 | 2026-09-15 | FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position… |
CVE-2026-91950 | Medium | 6.5 | 2026-09-15 | FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds… |
CVE-2026-91945 | Medium | 6.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed… |
CVE-2026-55211 | Critical | 9.8 | 2026-09-15 | Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, leading to a buffer o… |
CVE-2026-91786 | Medium | 6.1 | 2026-09-15 | A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions aga… |
CVE-2026-90826 | Low | 2.8 | 2026-09-14 | A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gf_node_del of the file scenegraph/base_scenegraph.c of the component MP… |
CVE-2026-86903 | Medium | 5.5 | 2026-09-14 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, wa… |
CVE-2026-86900 | Medium | 6.5 | 2026-09-14 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT vol… |
CVE-2026-84597 | Medium | 6.5 | 2026-09-14 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS… |
CVE-2026-84596 | Medium | 6.5 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, wat… |
CVE-2026-84572 | High | 7.1 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app ma… |
CVE-2026-84565 | High | 7.1 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processin… |
CVE-2026-84552 | Medium | 5.5 | 2026-09-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequo… |
CVE-2026-84549 | High | 7.5 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connectin… |
CVE-2026-84543 | High | 7.5 | 2026-09-14 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. C… |
CVE-2026-84532 | Medium | 5.4 | 2026-09-14 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden G… |
CVE-2026-84524 | Medium | 4.3 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27… |
CVE-2026-84516 | High | 8.1 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processin… |
CVE-2026-84509 | Medium | 6.5 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connectin… |
CVE-2026-65377 | Medium | 5.5 | 2026-09-14 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate… |
CVE-2026-65376 | Medium | 5.5 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app ma… |
CVE-2026-65365 | Medium | 6.5 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connectin… |
CVE-2026-65364 | High | 7.5 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote… |
CVE-2026-65359 | High | 7.1 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27… |
CVE-2026-64736 | High | 7.1 | 2026-09-14 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe… |
CVE-2026-43697 | High | 7.1 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processin… |
CVE-2026-43683 | High | 7.1 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app ma… |
CVE-2026-28968 | Medium | 5.5 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden G… |
CVE-2026-19086 | Low | 3.3 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this… |
CVE-2026-90815 | Medium | 6.3 | 2026-09-14 | A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convo… |
CVE-2026-55209 | Critical | 9.8 | 2026-09-14 | resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields… |
CVE-2026-55093 | Medium | 6.1 | 2026-09-14 | Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multi… |
CVE-2026-90994 | Medium | 4.0 | 2026-09-14 | A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client wi… |