CWE-125 · Out-of-bounds Read (page 5)
Page 5 of 99 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-68777 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67645 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67636 | Critical | 9.0 | 2026-09-08 | Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-67633 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network. |
CVE-2026-67630 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67629 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67624 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67389 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67369 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-62706 | High | 8.8 | 2026-09-08 | Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
CVE-2026-56198 | High | 7.8 | 2026-09-08 | Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally. |
CVE-2026-82066 | Medium | 4.3 | 2026-09-08 | A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privilege… |
CVE-2026-86714 | Medium | 5.4 | 2026-09-08 | PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attacke… |
CVE-2026-86303 | High | 7.3 | 2026-09-07 | A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. E… |
CVE-2026-86288 | Medium | 6.3 | 2026-09-07 | A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. This vulnerability affects unknown code of the file gptqmodel/nn_modules/qlinear/tritonv2.p… |
CVE-2026-20518 | Medium | 4.4 | 2026-09-07 | In geniezone, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor ha… |
CVE-2026-86227 | Low | 3.1 | 2026-09-06 | A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulatio… |
CVE-2026-31912 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with… |
CVE-2026-0799 | High | 8.7 | 2026-09-05 | In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libp… |
CVE-2025-15647 | Medium | 5.5 | 2026-09-05 | CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are computed in floating po… |
CVE-2025-15614 | Low | 3.3 | 2026-09-05 | ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malfor… |
CVE-2026-86137 | Low | 2.9 | 2026-09-05 | In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. |
CVE-2026-85769 | Medium | 6.5 | 2026-09-04 | A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on… |
CVE-2026-16660 | Medium | 5.3 | 2026-09-04 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read. |
CVE-2026-85698 | Medium | 5.5 | 2026-09-04 | Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without… |
CVE-2026-85522 | Medium | 5.3 | 2026-09-04 | A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_… |
CVE-2026-85505 | High | 7.5 | 2026-09-04 | ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC pro… |
CVE-2026-49509 | Medium | 4.4 | 2026-09-04 | Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers. This issue affects rLottie: 25648aef19187b3f87f4d9420b8d761453ad4630. |
CVE-2026-85455 | High | 8.2 | 2026-09-03 | MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet triggers out-of-bounds memory access during de… |
CVE-2026-85444 | High | 7.5 | 2026-09-03 | MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using… |
CVE-2026-64200 | High | 7.8 | 2026-09-03 | There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a past the end of an allocat… |
CVE-2026-64199 | High | 7.8 | 2026-09-03 | There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read outside the bounds of an all… |
CVE-2026-64198 | High | 7.8 | 2026-09-03 | There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a few bytes past the end of… |
CVE-2026-85052 | Low | 3.1 | 2026-09-03 | Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory… |
CVE-2026-84968 | Medium | 5.3 | 2026-09-03 | An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a… |
CVE-2026-85090 | Medium | 5.4 | 2026-09-03 | FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A ma… |
CVE-2026-71222 | Medium | 5.3 | 2026-09-03 | A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds vali… |
CVE-2026-84484 | High | 7.5 | 2026-09-02 | ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memor… |
CVE-2026-73761 | Medium | 6.5 | 2026-09-01 | An out-of-bounds read vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated information disclosure by sending a… |
CVE-2026-52295 | Low | 2.9 | 2026-09-01 | FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c. |
CVE-2026-84270 | Medium | 4.3 | 2026-09-01 | A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by th… |
CVE-2026-82618 | Medium | 4.3 | 2026-08-31 | A vulnerability was determined in Systerel S2OPC up to 1.7.3. The affected element is the function set_range_matrix_on_string_array of the file src/Common/opcu… |
CVE-2026-82608 | High | 7.4 | 2026-08-31 | A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of th… |
CVE-2026-82330 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memo… |
CVE-2026-82328 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palet… |
CVE-2026-82324 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the… |
CVE-2026-40015 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out… |
CVE-2026-78009 | | 2026-08-28 | An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) con… | |
CVE-2026-19317 | | 2026-08-28 | An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) con… | |
CVE-2026-19315 | | 2026-08-28 | A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending spec… | |
CVE-2026-82072 | High | 8.8 | 2026-08-28 | Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
CVE-2026-34616 | Medium | 5.5 | 2026-08-27 | DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this… |
CVE-2026-81334 | Medium | 6.1 | 2026-08-27 | darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-… |
CVE-2026-71402 | Medium | 5.4 | 2026-08-27 | An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as th… |
CVE-2026-13481 | Medium | 5.4 | 2026-08-26 | The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(), the PTP_MGMT_TIME… |
CVE-2026-13480 | Low | 3.1 | 2026-08-26 | The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command… |
CVE-2026-13479 | Low | 3.1 | 2026-08-26 | The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its comma… |
CVE-2026-80101 | Medium | 4.4 | 2026-08-25 | A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line pa… |
CVE-2026-79241 | Medium | 6.5 | 2026-08-25 | Out of bounds read in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML… |
CVE-2026-79239 | Medium | 6.5 | 2026-08-25 | Out of bounds read in Tint in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a… |
CVE-2026-79206 | Medium | 6.5 | 2026-08-25 | Out of bounds read in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory outside the san… |
CVE-2026-79112 | Medium | 6.5 | 2026-08-25 | Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory inside the… |
CVE-2026-79020 | High | 8.1 | 2026-08-25 | Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media… |
CVE-2026-79004 | Low | 3.4 | 2026-08-25 | Out of bounds read in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside t… |
CVE-2026-78989 | Critical | 9.6 | 2026-08-25 | Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the s… |
CVE-2026-78978 | High | 8.8 | 2026-08-25 | Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the s… |
CVE-2026-59981 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10… |
CVE-2026-65979 | | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4… | |
CVE-2026-61555 | Medium | 5.5 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11… |
CVE-2026-59985 | Medium | 5.5 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through… |
CVE-2026-75752 | Medium | 5.5 | 2026-08-25 | Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vul… |
CVE-2026-71441 | Medium | 5.5 | 2026-08-25 | Illustrator is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability… |
CVE-2026-59983 | Medium | 5.5 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11… |
CVE-2026-64203 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-64202 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-64201 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-59189 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 t… |
CVE-2026-24225 | Medium | 6.0 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an attacker could be able to cause an out-of-bounds read. A successful exploit of… |
CVE-2026-16234 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-13478 | Medium | 5.5 | 2026-08-25 | The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s_blocks_count - s_f… |
CVE-2026-56136 | Medium | 4.7 | 2026-08-24 | In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential inform… |
CVE-2026-16782 | Medium | 5.3 | 2026-08-24 | A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulner… |
CVE-2026-75369 | High | 7.1 | 2026-08-24 | An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software commit eaf90ec allows atta… |
CVE-2026-75370 | Medium | 6.5 | 2026-08-24 | An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers t… |
CVE-2026-78475 | Medium | 6.1 | 2026-08-24 | A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) o… |
CVE-2026-78157 | High | 7.4 | 2026-08-24 | A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Hand… |
CVE-2026-78049 | Low | 3.7 | 2026-08-22 | A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes of the file src/Cli… |
CVE-2026-77219 | High | 7.1 | 2026-08-21 | GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a craft… |
CVE-2026-77237 | Medium | 6.5 | 2026-08-21 | Missing queue-set type validation in xQueueAddToSet() in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSE… |
CVE-2026-54789 | High | 7.5 | 2026-08-21 | mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party… |
CVE-2026-50278 | Medium | 6.5 | 2026-08-21 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a `CIccEmbedIO::Read8()` size_t und… |
CVE-2026-20679 | Medium | 4.3 | 2026-08-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Processing a maliciously craf… |
CVE-2026-55894 | | 2026-08-20 | Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a ra… | |
CVE-2026-18716 | High | 7.9 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to a… |
CVE-2026-17423 | High | 7.7 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-boun… |
CVE-2026-17124 | High | 7.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds read. |
CVE-2026-17007 | Medium | 6.7 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds… |
CVE-2026-53587 | High | 7.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-76641 | High | 7.5 | 2026-08-20 | Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity pars… |
CVE-2026-63383 | | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decod… |