CWE-125 · Out-of-bounds Read (page 9)
Page 9 of 94 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-43051 | High | 8.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() funct… |
CVE-2026-43048 | High | 8.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: HID: core: Mitigate potential OOB by removing bogus memset() The memset() in hid_report_r… |
CVE-2026-43042 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platform_label{,s} pair The RCU-protected codepaths (mp… |
CVE-2026-43025 | High | 7.3 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Use the existing master… |
CVE-2026-43006 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: reject zero-length fixed buffer import validate_fixed_range() admits buf_a… |
CVE-2026-43005 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (tps53679) Fix array access with zero-length block read i2c_smbus_read_block_data(… |
CVE-2026-42479 | Medium | 5.5 | 2026-05-01 | An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to caus… |
CVE-2026-42478 | High | 7.5 | 2026-05-01 | An issue was discovered in VrmlData_IndexedFaceSet::TShape in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a den… |
CVE-2026-42477 | High | 7.1 | 2026-05-01 | A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows user-assisted at… |
CVE-2026-42476 | High | 7.1 | 2026-05-01 | Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii be… |
CVE-2026-31782 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: perf/x86: Fix potential bad container_of in intel_pmu_hw_config Auto counter reload may h… |
CVE-2026-31779 | High | 8.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() T… |
CVE-2026-31778 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix stack out-of-bounds read in init_card The loop creates a whitespace-stri… |
CVE-2026-31774 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() sqe->len is __u32 but gets… |
CVE-2026-31742 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: vt: discard stale unicode buffer on alt screen exit after resize When enter_alt_screen()… |
CVE-2026-31708 | High | 8.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path smb2_ioctl_query_info(… |
CVE-2026-40686 | Low | 3.7 | 2026-04-30 | In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header d… |
CVE-2026-33451 | High | 7.8 | 2026-04-30 | CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the Windows clien… |
CVE-2026-33450 | Medium | 5.5 | 2026-04-30 | CVE-2026-33450 is an out of bounds read vulnerability in the Secure Access MacOS client prior to 14.50. Attackers with control of a modified server can send… |
CVE-2026-28532 | Medium | 6.5 | 2026-04-30 | FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t… |
CVE-2026-42799 | High | 7.4 | 2026-04-30 | Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers. This vulnerability is associated with program files Code/Nr/nr_fw/RA… |
CVE-2026-7425 | Medium | 6.5 | 2026-04-29 | Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to… |
CVE-2026-2810 | | 2026-04-29 | Netskope was notified about a potential gap in the Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can poten… | |
CVE-2026-7354 | High | 8.8 | 2026-04-28 | Out of bounds read and write in Angle in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
CVE-2026-7320 | High | 7.5 | 2026-04-28 | Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1… |
CVE-2026-41607 | Medium | 6.5 | 2026-04-28 | Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which… |
CVE-2026-41604 | High | 8.2 | 2026-04-28 | Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which… |
CVE-2026-7233 | Low | 3.3 | 2026-04-28 | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the compo… |
CVE-2026-7135 | Medium | 5.3 | 2026-04-27 | A security flaw has been discovered in GPAC up to 26.03-DEV-rev105-g8f39a1eb3-master. Affected by this vulnerability is the function elng_box_read of the file… |
CVE-2026-6786 | High | 7.5 | 2026-04-26 | Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruptio… |
CVE-2026-6785 | High | 7.5 | 2026-04-26 | Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence… |
CVE-2026-31675 | High | 7.8 | 2026-04-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_netem: fix out-of-bounds access in packet corruption In netem_enqueue(), t… |
CVE-2026-41503 | High | 7.5 | 2026-04-24 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's ReadP… |
CVE-2026-41502 | High | 7.5 | 2026-04-24 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an off-by-one out-of-bounds read vulnerability in bacnet-st… |
CVE-2026-41475 | Critical | 9.1 | 2026-04-24 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's Write… |
CVE-2026-41415 | Critical | 9.1 | 2026-04-24 | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Con… |
CVE-2026-41677 | Critical | 9.1 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the leng… |
CVE-2026-41079 | Medium | 4.3 | 2026-04-24 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a cr… |
CVE-2026-31641 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rxgk() reads the raw… |
CVE-2026-31636 | Critical | 9.1 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator() copies auth… |
CVE-2026-31614 | High | 7.1 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix off-by-8 bounds check in check_wsl_eas() The bounds check uses (u8 *)ea… |
CVE-2026-31613 | High | 8.1 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_ST… |
CVE-2026-31570 | High | 8.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: can: gw: fix OOB heap access in cgw_csum_crc8_rel() cgw_csum_crc8_rel() correctly compute… |
CVE-2026-31569 | High | 7.3 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Handle the case that EIOINTC's coremap is empty EIOINTC's coremap in eioi… |
CVE-2026-31568 | High | 7.1 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: s390/mm: Add missing secure storage access fixups for donated memory There are special ca… |
CVE-2026-31558 | High | 8.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust kvm_get_vcpu_by_cpuid() takes a… |
CVE-2026-33317 | High | 8.7 | 2026-04-24 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technolog… |
CVE-2026-28525 | Medium | 6.8 | 2026-04-23 | SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a de… |
CVE-2026-6920 | Critical | 9.6 | 2026-04-23 | Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-34003 | High | 7.8 | 2026-04-23 | A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to… |
CVE-2026-33599 | Low | 3.1 | 2026-04-22 | A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newS… |
CVE-2026-33598 | Medium | 4.8 | 2026-04-22 | A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache. |
CVE-2026-31528 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: perf: Make sure to use pmu_ctx->pmu for groups Oliver reported that x86_pmu_del() ended u… |
CVE-2026-31513 | High | 8.1 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req Syzbot reported a… |
CVE-2026-31484 | High | 7.1 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check __io_uring_show_fdinfo() iterates o… |
CVE-2026-31464 | High | 8.1 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() A malicious or compromised… |
CVE-2026-31449 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_correct_indexes() walks… |
CVE-2026-31442 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix possible invalid memory access after FLR In the case that the first… |
CVE-2026-31435 | High | 8.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix read abandonment during retry Under certain circumstances, all the remaining s… |
CVE-2026-31433 | High | 8.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial OOB in get_file_all_info() for compound requests When a compound req… |
CVE-2026-40890 | High | 7.5 | 2026-04-21 | The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < chara… |
CVE-2026-24189 | High | 8.2 | 2026-04-21 | NVIDIA CUDA-Q contains a vulnerability in an endpoint, where an unauthenticated attacker could cause an out-of-bounds read by sending a maliciously crafted req… |
CVE-2026-6784 | High | 7.5 | 2026-04-21 | Memory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-0930 | Medium | 4.3 | 2026-04-20 | Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read… |
CVE-2026-31430 | High | 7.1 | 2026-04-20 | In the Linux kernel, the following vulnerability has been resolved: X.509: Fix out-of-bounds access when parsing extensions Leo reports an out-of-bounds acce… |
CVE-2026-40340 | Medium | 6.1 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read vulnerability in `ptp_unpack_OI()` in `camlib… |
CVE-2026-40339 | Medium | 5.2 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/p… |
CVE-2026-40338 | Medium | 5.2 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpa… |
CVE-2026-40335 | Medium | 5.2 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_DPV()` in `camlibs/ptp2/ptp-pa… |
CVE-2026-40333 | Medium | 6.1 | 2026-04-18 | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but n… |
CVE-2026-5720 | Critical | 9.1 | 2026-04-17 | miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information dis… |
CVE-2026-29013 | Critical | 9.8 | 2026-04-17 | libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely… |
CVE-2026-33689 | Critical | 9.1 | 2026-04-17 | xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remo… |
CVE-2026-33516 | Critical | 9.1 | 2026-04-17 | xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue occu… |
CVE-2026-40253 | Medium | 6.8 | 2026-04-16 | openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common lib… |
CVE-2026-41034 | Medium | 5.0 | 2026-04-16 | ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leadin… |
CVE-2026-6364 | Medium | 6.5 | 2026-04-15 | Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2026-6308 | High | 7.5 | 2026-04-15 | Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execut… |
CVE-2026-40917 | Medium | 5.0 | 2026-04-15 | A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image files… |
CVE-2026-27294 | High | 7.8 | 2026-04-14 | Adobe Framemaker versions 2022.8 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past… |
CVE-2026-33019 | High | 7.1 | 2026-04-14 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow leading to an out-of-bounds… |
CVE-2026-27287 | High | 7.8 | 2026-04-14 | InCopy versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-27289 | High | 7.8 | 2026-04-14 | Photoshop Desktop versions 27.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past… |
CVE-2026-33822 | Medium | 6.1 | 2026-04-14 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-33096 | High | 7.5 | 2026-04-14 | Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. |
CVE-2026-32188 | High | 7.1 | 2026-04-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-32076 | High | 7.8 | 2026-04-14 | Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
CVE-2026-27931 | Medium | 5.5 | 2026-04-14 | Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. |
CVE-2026-27930 | Medium | 5.5 | 2026-04-14 | Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. |
CVE-2026-26156 | High | 7.8 | 2026-04-14 | Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally. |
CVE-2026-26153 | High | 7.8 | 2026-04-14 | Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-27284 | High | 7.8 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a rea… |
CVE-2026-5713 | | 2026-04-14 | The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features… | |
CVE-2026-39979 | Medium | 6.5 | 2026-04-13 | jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer wit… |
CVE-2026-39956 | Medium | 6.1 | 2026-04-13 | jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the _strindices builtin in jq's src/builtin.c passes its argume… |
CVE-2026-33905 | Medium | 5.5 | 2026-04-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the -sample opera… |
CVE-2026-32605 | High | 7.5 | 2026-04-13 | nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an un… |
CVE-2026-30997 | High | 7.5 | 2026-04-13 | An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a craf… |
CVE-2026-25209 | Medium | 6.5 | 2026-04-13 | Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a7152… |
CVE-2026-25206 | Medium | 6.7 | 2026-04-13 | Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a7152… |