CWE-125 · Out-of-bounds Read (page 7)
Page 7 of 99 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-62745 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62743 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-62742 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62738 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. |
CVE-2026-62733 | High | 7.8 | 2026-08-11 | Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-62728 | High | 7.0 | 2026-08-11 | Time-of-check time-of-use (toctou) race condition in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-62720 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62718 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62716 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62715 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62714 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62703 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
CVE-2026-61933 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
CVE-2026-61924 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61921 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61918 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-59128 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally. |
CVE-2026-20786 | Medium | 6.1 | 2026-08-11 | Out-of-bounds read for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary… |
CVE-2026-20778 | Medium | 6.8 | 2026-08-11 | Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. Unprivileged software adver… |
CVE-2026-20749 | High | 8.8 | 2026-08-11 | Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow an escalation of privilege. Network adversary with a… |
CVE-2026-73075 | Low | 3.9 | 2026-08-11 | Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a… |
CVE-2026-73067 | | 2026-08-11 | Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_daw… | |
CVE-2026-18125 | High | 7.5 | 2026-08-11 | An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service. |
CVE-2026-17535 | Medium | 6.2 | 2026-08-11 | Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typi… |
CVE-2026-64629 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Parasolid V38.0 (All versions < V38.0.235), Parasolid V38.1 (All versions < V38.1.230). The affected applications contai… |
CVE-2026-59701 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability whil… |
CVE-2026-59700 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability whil… |
CVE-2026-50063 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected ap… |
CVE-2026-50062 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected ap… |
CVE-2026-50058 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected ap… |
CVE-2026-11809 | Low | 3.7 | 2026-08-10 | The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe resp… |
CVE-2026-72522 | Medium | 6.2 | 2026-08-10 | libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode proce… |
CVE-2026-15534 | Medium | 5.7 | 2026-08-09 | Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. Th… |
CVE-2026-11743 | Medium | 6.6 | 2026-08-07 | The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and write paths with the tes… |
CVE-2026-66151 | Medium | 5.5 | 2026-08-07 | SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a… |
CVE-2026-65819 | High | 7.5 | 2026-08-07 | gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets bef… |
CVE-2026-19082 | High | 7.5 | 2026-08-07 | Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags… |
CVE-2026-20347 | High | 7.5 | 2026-08-07 | A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded… |
CVE-2026-20346 | High | 7.5 | 2026-08-07 | A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded imp… |
CVE-2026-71560 | Critical | 9.1 | 2026-08-07 | Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing s… |
CVE-2026-54209 | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "(editini)" in the file path… | |
CVE-2026-7405 | Medium | 5.5 | 2026-08-06 | A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling librar… |
CVE-2026-71498 | Medium | 5.1 | 2026-08-06 | node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-… |
CVE-2026-70635 | High | 7.1 | 2026-08-06 | TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result int… |
CVE-2026-70634 | High | 8.1 | 2026-08-06 | TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/alg… |
CVE-2026-70633 | Medium | 6.5 | 2026-08-06 | TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows a… |
CVE-2026-5856 | High | 7.1 | 2026-08-06 | Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in ne… |
CVE-2026-5855 | High | 7.5 | 2026-08-06 | Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes fr… |
CVE-2026-43630 | Medium | 6.5 | 2026-08-06 | llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write ac… |
CVE-2026-43628 | High | 7.8 | 2026-08-06 | llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers… |
CVE-2026-11803 | High | 7.8 | 2026-08-06 | A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage thi… |
CVE-2026-19028 | | 2026-08-06 | H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the… | |
CVE-2026-19027 | | 2026-08-06 | The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance… | |
CVE-2026-67865 | High | 7.5 | 2026-08-05 | S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. This allows a remote attacker to cause a denial of service |
CVE-2026-70598 | Low | 3.9 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, of… |
CVE-2026-71256 | Critical | 9.8 | 2026-08-05 | nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic / recv_read_device_ide… |
CVE-2026-45705 | Medium | 5.3 | 2026-08-05 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the mult… |
CVE-2026-67857 | High | 7.5 | 2026-08-04 | open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua_client_connect.c. |
CVE-2026-68743 | Medium | 5.5 | 2026-08-04 | A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer siz… |
CVE-2026-18790 | Low | 3.3 | 2026-08-04 | A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse of the file src/Cl… |
CVE-2026-70368 | Medium | 6.5 | 2026-08-04 | A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attac… |
CVE-2026-69244 | | 2026-08-03 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parse… | |
CVE-2026-68742 | Medium | 5.5 | 2026-08-03 | A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body… |
CVE-2026-18583 | Medium | 5.3 | 2026-08-03 | A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mms… |
CVE-2026-20496 | Medium | 4.4 | 2026-08-03 | In geniezone, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has al… |
CVE-2026-20494 | Medium | 5.5 | 2026-08-03 | In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already… |
CVE-2026-20490 | Medium | 4.4 | 2026-08-03 | In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obta… |
CVE-2026-20489 | Medium | 4.4 | 2026-08-03 | In display, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has alr… |
CVE-2026-20488 | Medium | 4.4 | 2026-08-03 | In display, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has… |
CVE-2026-20479 | High | 7.5 | 2026-08-03 | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue b… |
CVE-2026-10848 | High | 7.0 | 2026-08-02 | The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract… |
CVE-2026-67306 | Medium | 5.4 | 2026-08-01 | FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and… |
CVE-2026-67301 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. Whe… |
CVE-2026-67291 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfre… |
CVE-2026-67290 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficien… |
CVE-2026-66401 | Low | 2.1 | 2026-08-01 | FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before… |
CVE-2026-10773 | Medium | 5.4 | 2026-08-01 | The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char * name table after a faulty bounds… |
CVE-2026-62959 | | 2026-07-31 | Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a… | |
CVE-2026-66720 | Medium | 6.5 | 2026-07-30 | The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages… |
CVE-2026-66369 | Medium | 6.5 | 2026-07-30 | The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus… |
CVE-2026-66364 | Medium | 6.5 | 2026-07-30 | The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When… |
CVE-2026-66360 | High | 7.5 | 2026-07-30 | The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of… |
CVE-2026-66349 | Medium | 6.5 | 2026-07-30 | The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER… |
CVE-2026-65421 | Medium | 6.5 | 2026-07-30 | The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read… |
CVE-2026-63550 | Medium | 6.5 | 2026-07-30 | The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded eleme… |
CVE-2026-63033 | Medium | 6.5 | 2026-07-30 | A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one b… |
CVE-2026-61893 | Medium | 6.5 | 2026-07-30 | A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of… |
CVE-2026-56758 | Medium | 6.5 | 2026-07-30 | The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, a… |
CVE-2026-55777 | | 2026-07-30 | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, the parse_ios()… | |
CVE-2026-67550 | Medium | 5.7 | 2026-07-30 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject b… |
CVE-2026-13379 | Critical | 9.1 | 2026-07-30 | The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a cr… |
CVE-2026-12996 | High | 8.1 | 2026-07-30 | A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or lea… |
CVE-2026-58216 | Medium | 5.3 | 2026-07-30 | An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-enc… |
CVE-2026-41703 | High | 7.6 | 2026-07-30 | VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds… |
CVE-2026-16530 | Medium | 6.5 | 2026-07-30 | A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sendi… |
CVE-2026-17995 | High | 8.1 | 2026-07-30 | Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (… |
CVE-2026-17971 | High | 8.8 | 2026-07-30 | Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform out of bounds memory access via… |
CVE-2026-17869 | High | 8.1 | 2026-07-30 | Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2026-17801 | Critical | 9.6 | 2026-07-30 | Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
CVE-2026-17772 | Medium | 4.3 | 2026-07-30 | Out of bounds read in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |