CWE-126 · Buffer Over-read (page 2)
Page 2 of 6 — CVEs classified under CWE-126, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0930 | Medium | 4.3 | 2026-04-20 | Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read… |
CVE-2026-40341 | Low | 3.5 | 2026-04-18 | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_unpack_EOS_FocusInfoEx could be used to… |
CVE-2026-26184 | High | 7.8 | 2026-04-14 | Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-26169 | Medium | 6.1 | 2026-04-14 | Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally. |
CVE-2026-26155 | Medium | 6.5 | 2026-04-14 | Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability |
CVE-2026-5772 | Medium | 5.3 | 2026-04-09 | A 1-byte stack buffer over-read was identified in the MatchDomainName function (src/internal.c) during wildcard hostname validation when the LEFT_MOST_WILDCARD… |
CVE-2026-21381 | High | 7.6 | 2026-04-06 | Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection. |
CVE-2026-21378 | High | 7.8 | 2026-04-06 | Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver. |
CVE-2026-21376 | High | 7.8 | 2026-04-06 | Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver. |
CVE-2026-21375 | High | 7.8 | 2026-04-06 | Memory Corruption when accessing an output buffer without validating its size during IOCTL processing. |
CVE-2026-21374 | High | 7.8 | 2026-04-06 | Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation. |
CVE-2026-21373 | High | 7.8 | 2026-04-06 | Memory Corruption when accessing an output buffer without validating its size during IOCTL processing. |
CVE-2026-21371 | High | 7.8 | 2026-04-06 | Memory Corruption when retrieving output buffer with insufficient size validation. |
CVE-2026-21367 | High | 7.6 | 2026-04-06 | Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans. |
CVE-2025-47400 | High | 7.1 | 2026-04-06 | Cryptographic issue while copying data to a destination buffer without validating its size. |
CVE-2025-47390 | High | 7.8 | 2026-04-06 | Memory corruption while preprocessing IOCTL request in JPEG driver. |
CVE-2026-2394 | Medium | 6.5 | 2026-04-01 | Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before… |
CVE-2026-24028 | Medium | 5.3 | 2026-03-31 | An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS… |
CVE-2025-66038 | Low | 3.9 | 2026-03-30 | OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In com… |
CVE-2026-4371 | High | 7.4 | 2026-03-24 | A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connectio… |
CVE-2025-59600 | High | 7.8 | 2026-03-02 | Memory Corruption when adding user-supplied data without checking available buffer space. |
CVE-2026-28364 | High | 7.9 | 2026-02-27 | In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-pha… |
CVE-2026-27799 | Medium | 4.0 | 2026-02-26 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-rea… |
CVE-2026-27798 | Medium | 4.0 | 2026-02-26 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-rea… |
CVE-2026-26271 | Medium | 5.3 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread in `freerdp_image_copy_from_icon_data()` (libfreerd… |
CVE-2026-3203 | Medium | 5.5 | 2026-02-25 | RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service |
CVE-2026-26282 | Medium | 6.6 | 2026-02-19 | NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap read in `.NET Single F… |
CVE-2026-25646 | High | 8.1 | 2026-02-10 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an… |
CVE-2026-20846 | High | 7.5 | 2026-02-10 | Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network. |
CVE-2025-47402 | Medium | 6.5 | 2026-02-02 | Transient DOS when processing a received frame with an excessively large authentication information element. |
CVE-2025-66692 | High | 7.5 | 2026-01-20 | A buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2025-60003 | High | 7.5 | 2026-01-15 | A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-base… |
CVE-2025-47395 | Medium | 6.5 | 2026-01-07 | Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element. |
CVE-2025-47331 | Medium | 6.1 | 2026-01-07 | Information disclosure while processing a firmware event. |
CVE-2025-47330 | Medium | 5.5 | 2026-01-07 | Transient DOS while parsing video packets received from the video firmware. |
CVE-2025-11961 | Low | 1.9 | 2025-12-31 | pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a wel… |
CVE-2025-62560 | High | 7.8 | 2025-12-09 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62473 | Medium | 6.5 | 2025-12-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-62467 | High | 7.8 | 2025-12-09 | Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62464 | High | 7.8 | 2025-12-09 | Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62462 | High | 7.8 | 2025-12-09 | Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62461 | High | 7.8 | 2025-12-09 | Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-12106 | Critical | 9.1 | 2025-12-01 | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses |
CVE-2025-63602 | High | 7.3 | 2025-11-18 | A vulnerability was discovered in Awesome Miner thru 11.2.4 that allows arbitrary read and write to kernel memory and MSRs (such as LSTAR) as an unprivileged u… |
CVE-2025-60720 | High | 7.8 | 2025-11-11 | Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally. |
CVE-2025-12745 | Medium | 5.3 | 2025-11-05 | A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file quickjs.c… |
CVE-2025-47368 | High | 7.8 | 2025-11-04 | Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing. |
CVE-2025-47362 | Medium | 6.1 | 2025-11-04 | Information disclosure while processing message from client with invalid payload. |
CVE-2025-27064 | Medium | 6.1 | 2025-11-04 | Information disclosure while registering commands from clients with diag through diagHal. |
CVE-2025-62792 | High | 7.5 | 2025-10-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match(… |
CVE-2025-62787 | High | 7.5 | 2025-10-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.10.2, a buffer over-read occurs in DecodeWinevt() when… |
CVE-2025-60729 | Medium | 5.3 | 2025-10-24 | PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function |
CVE-2025-55093 | Medium | 5.3 | 2025-10-17 | In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receiv… |
CVE-2025-55092 | Medium | 5.3 | 2025-10-17 | In Eclipse Foundation NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx… |
CVE-2025-55091 | Medium | 6.5 | 2025-10-16 | In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ip_packet_receive(… |
CVE-2025-55090 | Medium | 6.5 | 2025-10-16 | In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receiv… |
CVE-2025-55084 | Medium | 5.3 | 2025-10-16 | In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check in_nx_secure_tls_proc_clienthello_supported_v… |
CVE-2025-55083 | Medium | 5.3 | 2025-10-15 | In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check resulting it out by two out of bound read. |
CVE-2025-55081 | Critical | 9.1 | 2025-10-15 | In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of certai… |
CVE-2025-59192 | High | 7.8 | 2025-10-14 | Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-55325 | Medium | 5.5 | 2025-10-14 | Buffer over-read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-11617 | Medium | 5.4 | 2025-10-10 | A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving a IPv6 packet with incorrect pay… |
CVE-2025-11616 | Medium | 5.4 | 2025-10-10 | A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 packets of certain mess… |
CVE-2025-27049 | Medium | 5.5 | 2025-10-09 | Transient DOS while processing IOCTL call for image encoding. |
CVE-2025-27045 | Medium | 6.1 | 2025-10-09 | Information disclosure while processing batch command execution in Video driver. |
CVE-2025-27041 | Medium | 5.5 | 2025-10-09 | Transient DOS while processing video packets received from video firmware. |
CVE-2025-59933 | High | 7.8 | 2025-09-29 | libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input… |
CVE-2025-47328 | High | 7.5 | 2025-09-24 | Transient DOS while processing power control requests with invalid antenna or stream values. |
CVE-2025-47326 | High | 7.5 | 2025-09-24 | Transient DOS while handling command data during power control processing. |
CVE-2025-47318 | High | 7.5 | 2025-09-24 | Transient DOS while parsing the EPTM test control message to get the test pattern. |
CVE-2025-47317 | High | 7.8 | 2025-09-24 | Memory corruption due to global buffer overflow when a test command uses an invalid payload type. |
CVE-2025-27036 | Medium | 6.1 | 2025-09-24 | Information disclosure when Video engine escape input data is less than expected minimum size. |
CVE-2025-27033 | Medium | 6.1 | 2025-09-24 | Information disclosure while running video usecase having rogue firmware. |
CVE-2025-27030 | Medium | 6.1 | 2025-09-24 | information disclosure while invoking calibration data from user space to update firmware size. |
CVE-2025-21488 | High | 8.2 | 2025-09-24 | Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set. |
CVE-2025-21487 | High | 8.2 | 2025-09-24 | Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length. |
CVE-2025-21484 | High | 8.2 | 2025-09-24 | Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet. |
CVE-2025-4582 | High | 7.1 | 2025-09-23 | Buffer Over-read, Off-by-one Error vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation, Overread Buffers. This issue affects Co… |
CVE-2025-54901 | Medium | 5.5 | 2025-09-09 | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-53806 | Medium | 6.5 | 2025-09-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53798 | Medium | 6.5 | 2025-09-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53797 | Medium | 6.5 | 2025-09-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53796 | Medium | 6.5 | 2025-09-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-36855 | High | 8.8 | 2025-09-08 | A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://c… |
CVE-2025-53736 | Medium | 6.8 | 2025-08-12 | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2025-27068 | High | 7.8 | 2025-08-06 | Memory corruption while processing an IOCTL command with an arbitrary address. |
CVE-2025-27065 | High | 7.5 | 2025-08-06 | Transient DOS while processing a frame with malformed shared-key descriptor. |
CVE-2025-21457 | Medium | 6.1 | 2025-08-06 | Information disclosure while opening a fastrpc session when domain is not sanitized. |
CVE-2023-53159 | Medium | 4.5 | 2025-07-28 | The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host. |
CVE-2025-7745 | Medium | 5.8 | 2025-07-24 | Buffer Over-read vulnerability in ABB AC500 V2.This issue affects AC500 V2: through 2.5.2. |
CVE-2025-49684 | Medium | 5.5 | 2025-07-08 | Buffer over-read in Storage Port Driver allows an authorized attacker to disclose information locally. |
CVE-2025-49659 | High | 7.8 | 2025-07-08 | Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally. |
CVE-2025-47973 | High | 7.8 | 2025-07-08 | Buffer over-read in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-47971 | High | 7.8 | 2025-07-08 | Buffer over-read in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-27057 | High | 7.5 | 2025-07-08 | Transient DOS while handling beacon frames with invalid IE header length. |
CVE-2025-27055 | High | 7.8 | 2025-07-08 | Memory corruption during the image encoding process. |
CVE-2025-21454 | High | 7.5 | 2025-07-08 | Transient DOS while processing received beacon frame. |
CVE-2025-21449 | High | 7.5 | 2025-07-08 | Transient DOS may occur while processing malformed length field in SSID IEs. |
CVE-2025-21446 | High | 7.5 | 2025-07-08 | Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests. |
CVE-2025-21427 | High | 8.2 | 2025-07-08 | Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network. |