CWE-125 · Out-of-bounds Read (page 3)
Page 3 of 94 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66033 | High | 7.5 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/opens… |
CVE-2026-64255 | High | 8.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA sessio… |
CVE-2026-64247 | High | 8.4 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP… |
CVE-2026-64237 | High | 7.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - validate firmware size before use Ensure that the firmware file is larg… |
CVE-2026-64223 | High | 8.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211_tid_to_link_map_size_… |
CVE-2026-64209 | High | 7.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swing_tbl and pre_… |
CVE-2026-55732 | | 2026-07-24 | Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD thro… | |
CVE-2026-56391 | | 2026-07-24 | GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_fie… | |
CVE-2026-16002 | High | 8.2 | 2026-07-23 | The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service. |
CVE-2026-65918 | High | 7.1 | 2026-07-23 | PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback t… |
CVE-2026-16768 | Medium | 5.3 | 2026-07-23 | A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can oc… |
CVE-2026-43820 | High | 7.7 | 2026-07-23 | NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an AS… |
CVE-2026-13077 | High | 7.1 | 2026-07-22 | A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. Th… |
CVE-2026-64833 | High | 7.1 | 2026-07-22 | FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer bounda… |
CVE-2026-48029 | High | 7.1 | 2026-07-22 | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-in… |
CVE-2026-16473 | Medium | 4.3 | 2026-07-22 | A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap o… |
CVE-2026-16419 | Critical | 9.6 | 2026-07-21 | Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker to potentially perform a sandbox escape via… |
CVE-2026-47254 | Medium | 6.1 | 2026-07-21 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores… |
CVE-2026-47251 | Medium | 6.1 | 2026-07-21 | libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very s… |
CVE-2026-10680 | High | 7.6 | 2026-07-21 | The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum com… |
CVE-2026-45383 | | 2026-07-21 | libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decode… | |
CVE-2026-45382 | | 2026-07-21 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920… | |
CVE-2026-59147 | Critical | 9.8 | 2026-07-21 | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find. The attach-time vali… |
CVE-2026-59146 | High | 7.8 | 2026-07-21 | Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cel… |
CVE-2026-59145 | Critical | 9.1 | 2026-07-21 | Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find. The attach-time… |
CVE-2026-59143 | Medium | 6.3 | 2026-07-21 | Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rb_contains_locked… |
CVE-2026-46600 | High | 7.5 | 2026-07-21 | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. |
CVE-2026-59142 | Critical | 9.1 | 2026-07-21 | Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy. The attach-time va… |
CVE-2026-59141 | Critical | 9.1 | 2026-07-21 | Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked. The attach-time v… |
CVE-2026-59140 | Critical | 9.1 | 2026-07-21 | Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach… |
CVE-2026-59139 | Critical | 9.1 | 2026-07-21 | Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked. The attach-ti… |
CVE-2026-12548 | Medium | 4.2 | 2026-07-21 | A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse()… |
CVE-2026-16243 | High | 7.5 | 2026-07-21 | In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero. |
CVE-2026-9499 | | 2026-07-21 | An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NU… | |
CVE-2026-59842 | Low | 3.7 | 2026-07-21 | A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without… |
CVE-2026-64609 | Critical | 9.1 | 2026-07-21 | Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of t… |
CVE-2026-15903 | High | 8.8 | 2026-07-20 | Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-55639 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Conne… |
CVE-2026-64191 | High | 7.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA ca… |
CVE-2026-55645 | Medium | 6.5 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connectio… |
CVE-2026-44978 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulne… |
CVE-2026-35217 | Medium | 6.5 | 2026-07-20 | NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the final 1-byte `Subscription Options` field… |
CVE-2026-26197 | High | 7.5 | 2026-07-20 | HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's si… |
CVE-2026-16254 | Medium | 4.3 | 2026-07-20 | A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the sca… |
CVE-2026-64186 | High | 7.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommu_mmio_write() and… |
CVE-2026-64133 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access at reading cache find_control() to retrieve… |
CVE-2026-64126 | High | 7.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT_OP_ADD_EXT_ADV_DATA i… |
CVE-2026-64121 | High | 7.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: ifb: report ethtool stats over num_tx_queues ifb_dev_init() allocates dp->tx_private… |
CVE-2026-64114 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 raw_send_hdrinc() validates that the ca… |
CVE-2026-64102 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connect… |
CVE-2026-63807 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recove… |
CVE-2026-63799 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path In mm_cid_fixup_cpu… |
CVE-2026-63796 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2_validate_gd_parent() only bounds b… |
CVE-2026-53402 | High | 7.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() When fbcon_do_set_… |
CVE-2026-53390 | High | 8.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smb_check_perm_dacl() The permission-check ACE walk in s… |
CVE-2026-16013 | Medium | 5.3 | 2026-07-17 | A vulnerability has been found in liftoff-sr CIPster up to 632336d414ef708a542377c1aa8d6fdb7c70a760. Affected by this issue is the function CipAppPath::deseria… |
CVE-2026-44452 | Medium | 5.9 | 2026-07-16 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it co… |
CVE-2026-57077 | High | 7.7 | 2026-07-16 | YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_n… |
CVE-2026-57075 | Critical | 9.1 | 2026-07-16 | YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec. The base64 decoder in the bundled… |
CVE-2026-60073 | Medium | 5.9 | 2026-07-16 | An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system cras… |
CVE-2026-57896 | Medium | 6.1 | 2026-07-16 | An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request… |
CVE-2026-60140 | Medium | 6.1 | 2026-07-16 | An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request… |
CVE-2026-57074 | Critical | 9.1 | 2026-07-16 | XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such a… |
CVE-2026-57073 | Critical | 9.1 | 2026-07-16 | HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such… |
CVE-2026-47729 | Medium | 6.5 | 2026-07-16 | Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway… |
CVE-2026-45612 | Medium | 5.5 | 2026-07-16 | rz-libdemangle is a Rizin library for demangling symbols. Prior to 6bf56d3, the Rust demangler in src/rust/rust_v0.c can perform an out-of-bounds read when the… |
CVE-2026-38754 | Medium | 5.1 | 2026-07-15 | A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input. |
CVE-2026-62353 | Medium | 5.4 | 2026-07-15 | TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented p… |
CVE-2026-62351 | High | 7.5 | 2026-07-15 | TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg() read… |
CVE-2026-10673 | High | 8.3 | 2026-07-15 | The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mo… |
CVE-2026-60065 | Low | 3.7 | 2026-07-15 | When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers ca… |
CVE-2026-61862 | Low | 2.9 | 2026-07-15 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profi… |
CVE-2026-15030 | | 2026-07-15 | Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory re… | |
CVE-2026-47979 | Medium | 5.5 | 2026-07-14 | Media Encoder is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerabili… |
CVE-2026-15714 | Medium | 6.5 | 2026-07-14 | An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() fu… |
CVE-2026-15720 | High | 8.6 | 2026-07-14 | In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial o… |
CVE-2026-15712 | Medium | 5.9 | 2026-07-14 | A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library proce… |
CVE-2026-58539 | Medium | 6.5 | 2026-07-14 | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58529 | High | 7.1 | 2026-07-14 | Out-of-bounds read in Active Directory Federation Services (AD FS) allows an authorized attacker to disclose information over a network. |
CVE-2026-58528 | Medium | 6.8 | 2026-07-14 | Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack. |
CVE-2026-57094 | High | 8.8 | 2026-07-14 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
CVE-2026-57085 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally. |
CVE-2026-56195 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-56192 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-56186 | High | 8.1 | 2026-07-14 | Out-of-bounds read in Windows Schannel allows an authorized attacker to disclose information over a network. |
CVE-2026-56176 | High | 7.8 | 2026-07-14 | Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2026-55898 | Medium | 6.1 | 2026-07-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-55139 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55122 | High | 7.1 | 2026-07-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-55121 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55058 | High | 7.8 | 2026-07-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-55054 | Medium | 6.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-55050 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-55047 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55046 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-55045 | High | 8.4 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-55044 | High | 7.8 | 2026-07-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-55035 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55031 | High | 7.8 | 2026-07-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-55028 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |