CWE-125 · Out-of-bounds Read (page 5)
Page 5 of 94 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9263 | Medium | 6.5 | 2026-06-30 | The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fails to validate the length field of a framed ISO PDU start s… |
CVE-2026-10652 | Medium | 4.8 | 2026-06-30 | Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from DNS responses in dns_unpack_answer(), which validated only the fixed RR header (type, c… |
CVE-2026-8451 | High | 7.5 | 2026-06-30 | Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML I… |
CVE-2026-58011 | Medium | 6.5 | 2026-06-30 | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDat… |
CVE-2026-10817 | High | 7.5 | 2026-06-30 | Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP TimeStamp is enabled in TCP Profile and is associate… |
CVE-2026-56017 | High | 7.5 | 2026-06-29 | JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The rege… |
CVE-2026-43712 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visio… |
CVE-2026-43703 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Ta… |
CVE-2026-43676 | Medium | 6.5 | 2026-06-29 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-28979 | Medium | 6.5 | 2026-06-29 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-9267 | | 2026-06-29 | Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in the check_server_certificate() function… | |
CVE-2026-13522 | Medium | 4.3 | 2026-06-29 | A security flaw has been discovered in Investintech SlimPDFReader up to 2.0.14. Affected by this issue is the function SlimPDFReader!Investintech::PCV::TeighaD… |
CVE-2026-45258 | High | 7.8 | 2026-06-27 | dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could over… |
CVE-2026-48770 | Medium | 5.0 | 2026-06-26 | Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYD… |
CVE-2026-53303 | High | 7.1 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() In f2fs_sbi_show()… |
CVE-2026-54341 | High | 7.5 | 2026-06-26 | Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in Drago… |
CVE-2026-5757 | High | 7.5 | 2026-06-26 | Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap m… |
CVE-2026-12340 | High | 7.5 | 2026-06-25 | Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier com… |
CVE-2026-56788 | Medium | 4.4 | 2026-06-25 | RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attacke… |
CVE-2026-12897 | | 2026-06-25 | Horner Automation Cscape versions prior to 10.2 SP3 are vulnerable to an Out-of-Bounds Read vulnerability through parsing CSP files. Successful exploitation of… | |
CVE-2026-6094 | Critical | 9.1 | 2026-06-25 | Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data… |
CVE-2026-57454 | Medium | 6.1 | 2026-06-25 | Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and l… |
CVE-2026-57452 | Medium | 5.5 | 2026-06-25 | Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly… |
CVE-2026-57451 | Medium | 5.3 | 2026-06-25 | Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line… |
CVE-2026-57235 | High | 8.2 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked th… |
CVE-2026-4526 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These mess… |
CVE-2026-47154 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the proc… |
CVE-2026-47149 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These me… |
CVE-2026-47148 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process… |
CVE-2026-47147 | High | 7.1 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read bac… |
CVE-2026-53268 | High | 8.2 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've… |
CVE-2026-53255 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlv_data_is_valid() reads ea… |
CVE-2026-53254 | High | 8.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->… |
CVE-2026-53253 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU… |
CVE-2026-53230 | High | 8.7 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list mlx5_query_nic_vport_ma… |
CVE-2026-53224 | Critical | 9.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie(… |
CVE-2026-53179 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix buffer over-read in rtw_update_protection rtw_update_protection()… |
CVE-2026-53172 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix IFM region index out-of-bounds in command stream parser NPU_SET_IFM_REG… |
CVE-2026-53149 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does no… |
CVE-2026-53147 | High | 8.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request(… |
CVE-2026-53138 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS record-chain walk loops [Why & How] All record-chain walk lo… |
CVE-2026-13033 | High | 8.8 | 2026-06-24 | Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted… |
CVE-2026-53078 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops When a BPF sock_ops… |
CVE-2026-53076 | High | 7.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix OOB in pcpu_init_value An out-of-bounds read occurs when copying element from a … |
CVE-2026-53044 | High | 7.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables Fix incorrect ARRAY_SIZE… |
CVE-2026-53038 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ima_fs: Correctly create securityfs files for unsupported hash algos ima_tpm_chip->alloca… |
CVE-2026-52999 | Critical | 9.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), th… |
CVE-2026-52968 | High | 8.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic kvm_s390… |
CVE-2026-52967 | High | 8.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: smb/client: fix possible infinite loop and oob read in symlink_data() On 32-bit architect… |
CVE-2026-52958 | Critical | 9.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state an… |
CVE-2026-52956 | High | 7.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() In __ceph_x_decrypt()… |
CVE-2026-52955 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_… |
CVE-2026-52953 | High | 7.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix oops due to out of scope access Below oops triggers when kill QEMU proces… |
CVE-2026-56370 | Low | 3.3 | 2026-06-24 | ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with in… |
CVE-2026-52942 | High | 7.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dum… |
CVE-2026-52927 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix OOB read in compat_mtw_from_user Luxiao Xu says: The function… |
CVE-2026-52917 | High | 7.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: sctp: diag: reject stale associations in dump_one path The SCTP exact sock_diag lookup ca… |
CVE-2026-9539 | Medium | 6.5 | 2026-06-24 | An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor ho… |
CVE-2026-12892 | Medium | 4.4 | 2026-06-23 | A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice N… |
CVE-2026-12891 | Medium | 4.3 | 2026-06-23 | A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value, the… |
CVE-2020-9713 | Medium | 5.5 | 2026-06-23 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier are affected by an out… |
CVE-2020-9711 | Medium | 5.5 | 2026-06-23 | Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier are affected by an out-of-bounds read vulnerability that cou… |
CVE-2026-12969 | Medium | 5.3 | 2026-06-23 | An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with ex… |
CVE-2026-55654 | Low | 3.7 | 2026-06-23 | A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programmi… |
CVE-2026-10658 | High | 7.1 | 2026-06-23 | bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from… |
CVE-2026-10645 | Medium | 4.9 | 2026-06-23 | The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fields de_rec_len and de_name_len when walking a directory block. ext2_f… |
CVE-2026-48502 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attac… |
CVE-2026-56378 | Low | 3.7 | 2026-06-21 | ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a… |
CVE-2026-56367 | Low | 3.7 | 2026-06-21 | ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) t… |
CVE-2026-9265 | Critical | 9.1 | 2026-06-20 | Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 a… |
CVE-2026-49271 | Medium | 6.5 | 2026-06-19 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offs… |
CVE-2026-56210 | High | 7.1 | 2026-06-19 | A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding… |
CVE-2026-52910 | High | 7.8 | 2026-06-19 | In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below… |
CVE-2026-48138 | High | 7.5 | 2026-06-19 | There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may result in a denial of service. Successf… |
CVE-2025-62821 | Critical | 9.1 | 2026-06-19 | Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data si… |
CVE-2026-45696 | Medium | 6.5 | 2026-06-18 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.1… |
CVE-2025-15661 | Medium | 6.5 | 2026-06-18 | libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a m… |
CVE-2026-56099 | Medium | 5.3 | 2026-06-18 | OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allo… |
CVE-2026-50643 | | 2026-06-18 | 8cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-controlled filename… | |
CVE-2026-3894 | Critical | 9.1 | 2026-06-17 | Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.This issue affects Connext Professional: from 7.4.0 befor… |
CVE-2026-30802 | High | 8.2 | 2026-06-17 | Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.This issue affects Connext Micro: from 4.0.0 before 4.3.0, from… |
CVE-2026-48142 | Medium | 4.8 | 2026-06-17 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with bo… |
CVE-2026-12461 | Medium | 6.5 | 2026-06-17 | Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from pro… |
CVE-2026-12444 | Medium | 5.5 | 2026-06-17 | Out of bounds read in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to obtain potentially sensitive information from… |
CVE-2026-0165 | Medium | 5.7 | 2026-06-16 | In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information di… |
CVE-2026-0157 | Medium | 4.3 | 2026-06-16 | In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additiona… |
CVE-2026-0155 | Medium | 4.3 | 2026-06-16 | In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no addi… |
CVE-2026-0142 | Low | 3.3 | 2026-06-16 | In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure w… |
CVE-2026-0141 | Medium | 4.3 | 2026-06-16 | In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no a… |
CVE-2026-0140 | Medium | 4.3 | 2026-06-16 | In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure with no additio… |
CVE-2026-0136 | Medium | 6.5 | 2026-06-16 | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privil… |
CVE-2026-0135 | High | 7.8 | 2026-06-16 | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote code execution with no additional execution privilege… |
CVE-2026-0131 | High | 7.3 | 2026-06-16 | In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. This could lead to local escalation of privilege with no addit… |
CVE-2026-0130 | Low | 3.5 | 2026-06-16 | In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no a… |
CVE-2026-0128 | Medium | 6.5 | 2026-06-16 | In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with n… |
CVE-2026-0127 | Medium | 6.5 | 2026-06-16 | In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memory corruption. This could lead to remote… |
CVE-2026-4367 | Medium | 5.5 | 2026-06-16 | A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a… |
CVE-2026-47963 | Medium | 5.5 | 2026-06-16 | DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker coul… |
CVE-2026-47934 | Medium | 5.5 | 2026-06-16 | DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker coul… |
CVE-2026-47927 | Medium | 5.5 | 2026-06-16 | DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker coul… |