CWE-126 · Buffer Over-read

493 CVEs classified under CWE-126 (Buffer Over-read). Browse by severity and year.

Top CVEs for CWE-126
CVESeverityScorePublishedSummary
CVE-2017-17772Critical9.82024-11-26In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation.
CVE-2023-36397Critical9.82023-11-14Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVE-2019-3563Critical9.82019-04-29Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflow. This affects vers…
CVE-2018-14790Critical9.82018-10-01Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. A buffer over-read vulnera…
CVE-2017-7679Critical9.82017-06-20In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response…
CVE-2024-38373Critical9.62024-06-24FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Respon…
CVE-2025-12106Critical9.12025-12-01Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses
CVE-2025-55081Critical9.12025-10-15In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of certai…
CVE-2023-51773Critical9.12024-02-29BACnet Stack before 1.3.2 has a decode function APDU buffer over-read in bacapp_decode_application_data in bacapp.c.
CVE-2021-34584Critical9.12021-10-26Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2…
CVE-2019-11036Critical9.12019-05-03When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated…
CVE-2025-36855High8.82025-09-08A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://c…
CVE-2025-21176High8.82025-01-14.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2024-38265High8.82024-10-08Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2023-49285High8.62023-12-04Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack agai…
CVE-2022-20823High8.62022-08-25A vulnerability in the OSPF version 3 (OSPFv3) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (Do…
CVE-2022-20714High8.62022-04-15A vulnerability in the data plane microcode of Lightspeed-Plus line cards for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated…
CVE-2021-1588High8.62021-08-25A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to…
CVE-2021-1373High8.62021-03-24A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Wireless Controller Software for the Cis…
CVE-2020-3399High8.62020-09-24A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series…
All CVEs classified under CWE-126 — newest first (page 1 of 5)
CVESeverityScorePublishedSummary
CVE-2026-659362026-08-13A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information.  See vulnerability B-E4 in the relate…
CVE-2026-659332026-08-13A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper bel…
CVE-2026-18024Medium4.32026-08-13Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value…
CVE-2026-14678Medium4.32026-08-13Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory v…
CVE-2026-68819Medium5.92026-08-11Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network.
CVE-2026-65794Medium6.52026-08-11Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network.
CVE-2026-64905High7.82026-08-11Buffer over-read in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2026-62793Medium5.52026-08-11Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally.
CVE-2026-62746Medium5.52026-08-11Buffer over-read in Windows Win32K allows an authorized attacker to disclose information locally.
CVE-2026-62730Medium5.52026-08-11Buffer over-read in Windows Wired AutoConfig Service allows an authorized attacker to disclose information locally.
CVE-2026-61350Medium4.62026-08-11Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
CVE-2026-61347Medium5.52026-08-11Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.
CVE-2026-53414Medium6.52026-08-11Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on…
CVE-2026-20311Medium6.32026-08-05A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a den…
CVE-2026-25288High7.42026-08-04Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.
CVE-2026-66312Medium6.52026-08-04Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
CVE-2026-55970Medium6.52026-07-27Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0…
CVE-2026-55238Medium5.32026-07-20xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capa…
CVE-2026-63091Medium6.52026-07-20ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated…
CVE-2026-47088Low3.12026-07-16An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could cr…
CVE-2026-62353Medium5.42026-07-15TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented p…
CVE-2026-49854Medium5.32026-07-14Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mas…
CVE-2026-57968High7.82026-07-14Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CVE-2026-55036High7.82026-07-14Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-50504Medium6.52026-07-14Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
CVE-2026-50485Medium4.52026-07-14Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.
CVE-2026-50475Medium5.52026-07-14Buffer over-read in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2026-50468Medium6.52026-07-14Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-50445Medium6.52026-07-14Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a network.
CVE-2026-50435High7.82026-07-14Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVE-2026-50402High7.82026-07-14Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-50383Medium6.12026-07-14Buffer over-read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
CVE-2026-50372High7.02026-07-14Buffer over-read in Windows Redirected Drive Buffering allows an authorized attacker to elevate privileges locally.
CVE-2026-50341Medium5.52026-07-14Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally.
CVE-2026-59840Medium4.32026-07-14A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, Fort…
CVE-2025-43892Medium4.32026-07-14A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, Fort…
CVE-2026-50813Medium6.12026-07-08An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/chang…
CVE-2026-21379High7.82026-07-06Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.
CVE-2026-58013Medium6.52026-06-30A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length…
CVE-2026-58012Medium6.52026-06-30A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacemen…
CVE-2026-58010Medium6.52026-06-30A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padd…
CVE-2026-41992High7.52026-06-29GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decom…
CVE-2026-40210Medium4.82026-06-25An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.
CVE-2026-45460Medium4.72026-06-09Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-42828High7.82026-06-09Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-11787Medium5.02026-06-09A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer…
CVE-2026-44185High7.32026-06-08Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: f…
CVE-2026-45684Medium4.92026-06-02OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enr…
CVE-2025-59609Medium5.52026-06-01Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
CVE-2026-5260High8.22026-05-26A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed…
CVE-2026-6575Medium4.32026-05-14Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of…
CVE-2026-8463Medium5.32026-05-13Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input. The auto-detect form of arg…
CVE-2025-47406Medium6.12026-05-04Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.
CVE-2025-47403Medium6.52026-05-04Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
CVE-2025-47401Medium6.52026-05-04Transient DOS when processing target power rate tables during channel configuration.
CVE-2026-34059High7.52026-05-04Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4…
CVE-2026-37532High7.12026-05-01AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_le…
CVE-2026-6532Medium5.52026-04-30Kismet protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
CVE-2026-6238Medium6.52026-04-28The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against th…
CVE-2026-41898Medium5.32026-04-24rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk…
CVE-2026-0930Medium4.32026-04-20Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read…
CVE-2026-40341Low3.52026-04-18libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_unpack_EOS_FocusInfoEx could be used to…
CVE-2026-26184High7.82026-04-14Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVE-2026-26169Medium6.12026-04-14Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally.
CVE-2026-26155Medium6.52026-04-14Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
CVE-2026-5772Medium5.32026-04-09A 1-byte stack buffer over-read was identified in the MatchDomainName function (src/internal.c) during wildcard hostname validation when the LEFT_MOST_WILDCARD…
CVE-2026-21381High7.62026-04-06Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.
CVE-2026-21378High7.82026-04-06Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
CVE-2026-21376High7.82026-04-06Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
CVE-2026-21375High7.82026-04-06Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
CVE-2026-21374High7.82026-04-06Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.
CVE-2026-21373High7.82026-04-06Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
CVE-2026-21371High7.82026-04-06Memory Corruption when retrieving output buffer with insufficient size validation.
CVE-2026-21367High7.62026-04-06Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.
CVE-2025-47400High7.12026-04-06Cryptographic issue while copying data to a destination buffer without validating its size.
CVE-2025-47390High7.82026-04-06Memory corruption while preprocessing IOCTL request in JPEG driver.
CVE-2026-2394Medium6.52026-04-01Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.This issue affects Connext Professional: from 7.4.0 before…
CVE-2026-24028Medium5.32026-03-31An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS…
CVE-2025-66038Low3.92026-03-30OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In com…
CVE-2026-4371High7.42026-03-24A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connectio…
CVE-2025-59600High7.82026-03-02Memory Corruption when adding user-supplied data without checking available buffer space.
CVE-2026-28364High7.92026-02-27In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-pha…
CVE-2026-27799Medium4.02026-02-26ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-rea…
CVE-2026-27798Medium4.02026-02-26ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-rea…
CVE-2026-26271Medium5.32026-02-25FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread in `freerdp_image_copy_from_icon_data()` (libfreerd…
CVE-2026-3203Medium5.52026-02-25RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service
CVE-2026-26282Medium6.62026-02-19NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap read in `.NET Single F…
CVE-2026-25646High8.12026-02-10LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an…
CVE-2026-20846High7.52026-02-10Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.
CVE-2025-47402Medium6.52026-02-02Transient DOS when processing a received frame with an excessively large authentication information element.
CVE-2025-66692High7.52026-01-20A buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service (DoS) v…
CVE-2025-60003High7.52026-01-15A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-base…
CVE-2025-47395Medium6.52026-01-07Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.
CVE-2025-47331Medium6.12026-01-07Information disclosure while processing a firmware event.
CVE-2025-47330Medium5.52026-01-07Transient DOS while parsing video packets received from the video firmware.
CVE-2025-11961Low1.92025-12-31pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a wel…
CVE-2025-62560High7.82025-12-09Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62473Medium6.52025-12-09Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVE-2025-62467High7.82025-12-09Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVE-2025-62464High7.82025-12-09Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.