CWE-125 · Out-of-bounds Read (page 8)
Page 8 of 99 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-17770 | Medium | 5.8 | 2026-07-30 | Out of bounds read in Media in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-17745 | Medium | 5.8 | 2026-07-30 | Out of bounds read in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-17701 | Critical | 9.6 | 2026-07-30 | Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer p… |
CVE-2026-17678 | High | 8.8 | 2026-07-30 | Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-64685 | Medium | 5.3 | 2026-07-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check fo… |
CVE-2026-10684 | Low | 3.0 | 2026-07-29 | In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredump header directly as an index into cor… |
CVE-2026-17550 | Medium | 5.5 | 2026-07-29 | A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this… |
CVE-2026-16465 | Medium | 6.1 | 2026-07-29 | A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this… |
CVE-2026-58160 | Medium | 6.5 | 2026-07-29 | Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through… |
CVE-2026-50735 | Medium | 6.8 | 2026-07-28 | pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting i… |
CVE-2026-42494 | Medium | 6.1 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge… |
CVE-2026-17072 | Low | 3.3 | 2026-07-28 | A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Mat… |
CVE-2026-64776 | Medium | 5.5 | 2026-07-27 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to… |
CVE-2026-64768 | High | 8.1 | 2026-07-27 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-64762 | Critical | 9.8 | 2026-07-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14… |
CVE-2026-64719 | High | 8.1 | 2026-07-27 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPa… |
CVE-2026-64692 | High | 7.1 | 2026-07-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequo… |
CVE-2026-43817 | Medium | 5.5 | 2026-07-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6… |
CVE-2026-43809 | Critical | 9.8 | 2026-07-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14… |
CVE-2026-43773 | Critical | 9.8 | 2026-07-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Mounting… |
CVE-2026-43767 | Medium | 5.0 | 2026-07-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able t… |
CVE-2026-43757 | Critical | 9.8 | 2026-07-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14… |
CVE-2026-43753 | Medium | 4.6 | 2026-07-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8… |
CVE-2026-43747 | High | 7.1 | 2026-07-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Parsing… |
CVE-2026-43738 | Medium | 5.5 | 2026-07-27 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS… |
CVE-2026-66759 | High | 7.1 | 2026-07-27 | A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer wi… |
CVE-2026-66731 | High | 7.5 | 2026-07-27 | facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote att… |
CVE-2026-66729 | High | 7.5 | 2026-07-27 | facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to cras… |
CVE-2026-17572 | Medium | 5.5 | 2026-07-27 | Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (cr… |
CVE-2026-15003 | Medium | 5.6 | 2026-07-27 | A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a s… |
CVE-2026-17512 | Low | 3.3 | 2026-07-27 | A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation le… |
CVE-2026-58662 | Critical | 9.1 | 2026-07-27 | Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0… |
CVE-2026-58023 | Critical | 9.1 | 2026-07-27 | Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to versi… |
CVE-2026-64450 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE_MSG c… |
CVE-2026-64448 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption to responses without data area smb2_check_… |
CVE-2026-64445 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bu… |
CVE-2026-64444 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsing loop in OnAssocRs… |
CVE-2026-64443 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in u… |
CVE-2026-64442 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Two… |
CVE-2026-64441 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_… |
CVE-2026-64436 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: net: af_key: initialize alg_key_len for IPComp states pfkey_msg2xfrm_state() handles the… |
CVE-2026-64411 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find_table_lock() update_counters() and… |
CVE-2026-64407 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() During the… |
CVE-2026-64364 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mt_io_flags mt_io_flags is a single unsi… |
CVE-2026-64355 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for a… |
CVE-2026-64339 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbio_bulk_msg()… |
CVE-2026-64320 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_… |
CVE-2026-64319 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_repl… |
CVE-2026-64317 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record get_symlink_chunk() and the S… |
CVE-2026-64299 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessar… |
CVE-2026-64277 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes… |
CVE-2026-66337 | Medium | 6.5 | 2026-07-24 | A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing mu… |
CVE-2026-66034 | High | 7.5 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-lengt… |
CVE-2026-66033 | High | 7.5 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/opens… |
CVE-2026-64255 | High | 8.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA sessio… |
CVE-2026-64247 | High | 8.4 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP… |
CVE-2026-64237 | High | 7.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - validate firmware size before use Ensure that the firmware file is larg… |
CVE-2026-64223 | High | 8.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211_tid_to_link_map_size_… |
CVE-2026-64209 | High | 7.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swing_tbl and pre_… |
CVE-2026-55732 | | 2026-07-24 | Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD thro… | |
CVE-2026-56391 | Medium | 6.1 | 2026-07-24 | GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_fie… |
CVE-2026-16002 | High | 8.2 | 2026-07-23 | The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service. |
CVE-2026-65918 | High | 7.1 | 2026-07-23 | PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback t… |
CVE-2026-16768 | Medium | 5.3 | 2026-07-23 | A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can oc… |
CVE-2026-43820 | High | 7.7 | 2026-07-23 | NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an AS… |
CVE-2026-13077 | High | 7.1 | 2026-07-22 | A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. Th… |
CVE-2026-64833 | High | 7.1 | 2026-07-22 | FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer bounda… |
CVE-2026-48029 | High | 7.1 | 2026-07-22 | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-in… |
CVE-2026-16473 | Medium | 4.3 | 2026-07-22 | A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap o… |
CVE-2026-16419 | Critical | 9.6 | 2026-07-21 | Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker to potentially perform a sandbox escape via… |
CVE-2026-47254 | Medium | 6.1 | 2026-07-21 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores… |
CVE-2026-47251 | Medium | 6.1 | 2026-07-21 | libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very s… |
CVE-2026-10680 | High | 7.6 | 2026-07-21 | The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum com… |
CVE-2026-45383 | | 2026-07-21 | libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decode… | |
CVE-2026-45382 | | 2026-07-21 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920… | |
CVE-2026-59147 | Critical | 9.8 | 2026-07-21 | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find. The attach-time vali… |
CVE-2026-59146 | High | 7.8 | 2026-07-21 | Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cel… |
CVE-2026-59145 | Critical | 9.1 | 2026-07-21 | Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find. The attach-time… |
CVE-2026-59143 | Medium | 6.3 | 2026-07-21 | Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rb_contains_locked… |
CVE-2026-46600 | High | 7.5 | 2026-07-21 | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. |
CVE-2026-59142 | Critical | 9.1 | 2026-07-21 | Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy. The attach-time va… |
CVE-2026-59141 | Critical | 9.1 | 2026-07-21 | Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked. The attach-time v… |
CVE-2026-59140 | Critical | 9.1 | 2026-07-21 | Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach… |
CVE-2026-59139 | Critical | 9.1 | 2026-07-21 | Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked. The attach-ti… |
CVE-2026-12548 | Medium | 4.2 | 2026-07-21 | A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse()… |
CVE-2026-16243 | High | 7.5 | 2026-07-21 | In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero. |
CVE-2026-9499 | | 2026-07-21 | An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NU… | |
CVE-2026-59842 | Low | 3.7 | 2026-07-21 | A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without… |
CVE-2026-64609 | Critical | 9.1 | 2026-07-21 | Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of t… |
CVE-2026-15903 | High | 8.8 | 2026-07-20 | Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-55639 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Conne… |
CVE-2026-64191 | High | 7.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA ca… |
CVE-2026-55645 | Medium | 6.5 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connectio… |
CVE-2026-44978 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulne… |
CVE-2026-35217 | Medium | 6.5 | 2026-07-20 | NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the final 1-byte `Subscription Options` field… |
CVE-2026-26197 | High | 7.5 | 2026-07-20 | HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's si… |
CVE-2026-16254 | Medium | 4.3 | 2026-07-20 | A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the sca… |
CVE-2026-64186 | High | 7.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommu_mmio_write() and… |
CVE-2026-64133 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access at reading cache find_control() to retrieve… |
CVE-2026-64126 | High | 7.3 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT_OP_ADD_EXT_ADV_DATA i… |