CWE-125 · Out-of-bounds Read (page 6)
Page 6 of 99 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63383 | | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decod… | |
CVE-2026-54616 | High | 7.1 | 2026-08-20 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742… |
CVE-2026-18278 | Low | 3.5 | 2026-08-20 | Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose… |
CVE-2026-76989 | Medium | 5.3 | 2026-08-20 | A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/… |
CVE-2026-76988 | Medium | 5.3 | 2026-08-20 | A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forward_open of the f… |
CVE-2026-76929 | Medium | 4.7 | 2026-08-19 | Pcapng file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76924 | Medium | 5.5 | 2026-08-19 | Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76923 | Medium | 5.5 | 2026-08-19 | Bluetooth HFP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76882 | Medium | 4.7 | 2026-08-19 | Bluetooth Attribute Protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-69550 | Medium | 6.5 | 2026-08-19 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-17015 | Medium | 5.4 | 2026-08-19 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds… |
CVE-2026-17042 | High | 7.3 | 2026-08-19 | IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in… |
CVE-2026-17028 | Medium | 6.5 | 2026-08-19 | IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in par… |
CVE-2026-16891 | Low | 3.3 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-16883 | Medium | 5.5 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-16866 | Medium | 4.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds read. |
CVE-2026-16839 | Critical | 9.4 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options… |
CVE-2026-16833 | Medium | 5.3 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to disclose kernel memory due to an out-of-bounds read. |
CVE-2026-16707 | High | 8.2 | 2026-08-19 | IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the… |
CVE-2026-16828 | High | 7.6 | 2026-08-19 | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in… |
CVE-2026-55564 | Medium | 5.4 | 2026-08-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index… |
CVE-2026-55192 | High | 8.2 | 2026-08-19 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream… |
CVE-2026-75147 | High | 7.1 | 2026-08-19 | FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for… |
CVE-2026-75146 | High | 8.1 | 2026-08-19 | FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNum… |
CVE-2026-75900 | Medium | 6.1 | 2026-08-19 | An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where… |
CVE-2026-58087 | High | 7.8 | 2026-08-19 | The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized… |
CVE-2026-62292 | | 2026-08-18 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compr… | |
CVE-2026-62291 | Medium | 5.3 | 2026-08-18 | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary al… |
CVE-2026-12632 | Medium | 6.5 | 2026-08-18 | Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptp_msg… |
CVE-2026-50126 | Medium | 4.0 | 2026-08-18 | Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote se… |
CVE-2026-75904 | Low | 3.3 | 2026-08-18 | libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index… |
CVE-2026-75032 | Medium | 6.3 | 2026-08-18 | A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) im… |
CVE-2026-63632 | Low | 3.3 | 2026-08-18 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_converter.convert_version(… |
CVE-2026-23935 | Medium | 4.9 | 2026-08-18 | A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potenti… |
CVE-2026-75090 | Medium | 4.3 | 2026-08-18 | A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convert_gguf_to_hf_tokenizer of the file mistralrs… |
CVE-2026-65349 | Medium | 6.6 | 2026-08-17 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2… |
CVE-2026-64784 | Medium | 4.3 | 2026-08-17 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and… |
CVE-2026-65832 | High | 8.2 | 2026-08-17 | Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) va… |
CVE-2026-63409 | High | 8.2 | 2026-08-17 | Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to… |
CVE-2026-74238 | High | 7.5 | 2026-08-17 | TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers t… |
CVE-2026-71980 | High | 7.5 | 2026-08-17 | Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthent… |
CVE-2026-12630 | Medium | 4.3 | 2026-08-17 | Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destinati… |
CVE-2026-40144 | | 2026-08-17 | A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior to version 26.1.2… | |
CVE-2026-19955 | Low | 3.5 | 2026-08-16 | A vulnerability was detected in TrailDB 0.6. Impacted is the function tdb_open of the file /src/tdb.c of the component TOC Validation. The manipulation results… |
CVE-2026-49282 | Medium | 5.1 | 2026-08-14 | Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to… |
CVE-2026-18020 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking. |
CVE-2026-17649 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-17226 | Medium | 5.4 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds r… |
CVE-2026-17212 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read. |
CVE-2026-16878 | Medium | 5.4 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-16861 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read. |
CVE-2026-16859 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-16853 | Medium | 6.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-55402 | Medium | 5.9 | 2026-08-13 | CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send sp… |
CVE-2026-73515 | High | 8.1 | 2026-08-13 | PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malfor… |
CVE-2026-14256 | Medium | 4.7 | 2026-08-13 | ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated… |
CVE-2026-73583 | Medium | 6.6 | 2026-08-13 | A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-… |
CVE-2026-17485 | High | 8.2 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive information due to an integer underflow. |
CVE-2026-19654 | High | 7.5 | 2026-08-12 | A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery c… |
CVE-2026-73434 | Medium | 6.1 | 2026-08-12 | A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries i… |
CVE-2026-19643 | Medium | 5.3 | 2026-08-12 | An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an… |
CVE-2026-16863 | High | 7.7 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-12232 | Medium | 6.1 | 2026-08-12 | The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no rang… |
CVE-2026-18694 | High | 7.1 | 2026-08-11 | An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be… |
CVE-2026-18688 | High | 7.1 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed nu… |
CVE-2026-70328 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70327 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70315 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70310 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-68814 | High | 7.8 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68813 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68808 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68802 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68797 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68793 | High | 7.8 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-66809 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-66806 | Medium | 5.5 | 2026-08-11 | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-65787 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-65786 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-65784 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-65662 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows GDI allows an authorized attacker to disclose information locally. |
CVE-2026-64917 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-64909 | High | 7.8 | 2026-08-11 | Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-64899 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-63531 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-63530 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-63529 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-63528 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-63524 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-63521 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-63517 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-63515 | High | 7.8 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-62887 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-62880 | High | 7.8 | 2026-08-11 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
CVE-2026-62876 | High | 7.8 | 2026-08-11 | Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-62842 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-62814 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62796 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-62786 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-62782 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Windows SMB Client allows an unauthorized attacker to disclose information over a network. |