CWE-126 · Buffer Over-read (page 3)
Page 3 of 6 — CVEs classified under CWE-126, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24068 | Medium | 5.5 | 2025-06-10 | Buffer over-read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-27029 | High | 7.5 | 2025-06-03 | Transient DOS while processing the tone measurement response buffer when the response buffer is out of range. |
CVE-2025-21463 | High | 7.5 | 2025-06-03 | Transient DOS while processing the EHT operation IE in the received beacon frame. |
CVE-2024-53026 | High | 8.2 | 2025-06-03 | Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call. |
CVE-2024-53021 | High | 8.2 | 2025-06-03 | Information disclosure may occur while processing goodbye RTCP packet from network. |
CVE-2024-53020 | High | 8.2 | 2025-06-03 | Information disclosure may occur while decoding the RTP packet with invalid header extension from network. |
CVE-2024-53019 | High | 8.2 | 2025-06-03 | Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources. |
CVE-2025-47295 | Low | 3.7 | 2025-05-28 | A buffer over-read in Fortinet FortiOS versions 7.4.0 through 7.4.3, versions 7.2.0 through 7.2.7, and versions 7.0.0 through 7.0.14 may allow a remote unauthe… |
CVE-2024-52879 | High | 7.5 | 2025-05-15 | An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel… |
CVE-2024-52878 | High | 7.5 | 2025-05-15 | An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel… |
CVE-2024-52877 | High | 7.5 | 2025-05-15 | An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel… |
CVE-2025-32704 | High | 8.4 | 2025-05-13 | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-29956 | Medium | 5.4 | 2025-05-13 | Buffer over-read in Windows SMB allows an authorized attacker to disclose information over a network. |
CVE-2025-4207 | Medium | 5.9 | 2025-05-08 | Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte… |
CVE-2025-21475 | High | 7.8 | 2025-05-06 | Memory corruption while processing escape code, when DisplayId is passed with large unsigned value. |
CVE-2025-21459 | High | 7.5 | 2025-05-06 | Transient DOS while parsing per STA profile in ML IE. |
CVE-2024-49847 | High | 7.5 | 2025-05-06 | Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE. |
CVE-2024-49846 | High | 8.2 | 2025-05-06 | Memory corruption while decoding of OTA messages from T3448 IE. |
CVE-2024-45568 | Medium | 6.7 | 2025-05-06 | Memory corruption due to improper bounds check while command handling in camera-kernel driver. |
CVE-2025-26676 | Medium | 6.5 | 2025-04-08 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-26672 | Medium | 6.5 | 2025-04-08 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-26664 | Medium | 6.5 | 2025-04-08 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-21203 | Medium | 6.5 | 2025-04-08 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-21448 | High | 7.5 | 2025-04-07 | Transient DOS may occur while parsing SSID in action frames. |
CVE-2025-21435 | High | 7.5 | 2025-04-07 | Transient DOS may occur while parsing extended IE in beacon. |
CVE-2025-21434 | High | 7.5 | 2025-04-07 | Transient DOS may occur while parsing EHT operation IE or EHT capability IE. |
CVE-2025-21430 | High | 7.5 | 2025-04-07 | Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session. |
CVE-2025-21429 | High | 7.5 | 2025-04-07 | Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request. |
CVE-2025-21428 | High | 7.5 | 2025-04-07 | Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session. |
CVE-2025-21421 | High | 7.8 | 2025-04-07 | Memory corruption while processing escape code in API. |
CVE-2024-45552 | High | 8.2 | 2025-04-07 | Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards. |
CVE-2025-32053 | Medium | 6.5 | 2025-04-03 | A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read. |
CVE-2025-32052 | Medium | 6.5 | 2025-04-03 | A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read. |
CVE-2025-24992 | Medium | 5.5 | 2025-03-11 | Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information locally. |
CVE-2024-12975 | | 2025-03-07 | A buffer overread can occur in the CPC application when operating in full duplex SPI upon receiving an invalid packet over the SPI interface. | |
CVE-2024-43056 | Medium | 5.5 | 2025-03-03 | Transient DOS during hypervisor virtual I/O operation in a virtual machine. |
CVE-2024-57970 | Medium | 4.0 | 2025-02-16 | libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles… |
CVE-2024-12011 | High | 7.6 | 2025-02-13 | A CWE-126 “Buffer Over-read” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The information disclosure can be triggered by… |
CVE-2024-49839 | High | 8.2 | 2025-02-03 | Memory corruption during management frame processing due to mismatch in T2LM info element. |
CVE-2024-49838 | High | 8.2 | 2025-02-03 | Information disclosure while parsing the OCI IE with invalid length. |
CVE-2024-45561 | High | 7.8 | 2025-02-03 | Memory corruption while handling IOCTL call from user-space to set latency level. |
CVE-2024-38417 | Medium | 6.1 | 2025-02-03 | Information disclosure while processing IO control commands. |
CVE-2024-38416 | Medium | 6.1 | 2025-02-03 | Information disclosure during audio playback. |
CVE-2024-38414 | Medium | 6.1 | 2025-02-03 | Information disclosure while processing information on firmware image during core initialization. |
CVE-2024-38404 | High | 7.5 | 2025-02-03 | Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem. |
CVE-2025-21277 | High | 7.5 | 2025-01-14 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2025-21271 | High | 7.8 | 2025-01-14 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2025-21176 | High | 8.8 | 2025-01-14 | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
CVE-2024-45559 | Medium | 5.5 | 2025-01-06 | Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend. |
CVE-2024-45558 | High | 7.5 | 2025-01-06 | Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length. |
CVE-2024-45548 | High | 7.8 | 2025-01-06 | Memory corruption while processing FIPS encryption or decryption validation functionality IOCTL call. |
CVE-2024-45546 | High | 7.8 | 2025-01-06 | Memory corruption while processing FIPS encryption or decryption IOCTL call invoked from user-space. |
CVE-2024-43063 | Medium | 6.1 | 2025-01-06 | information disclosure while invoking the mailbox read API. |
CVE-2024-33067 | Medium | 6.1 | 2025-01-06 | Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver. |
CVE-2024-33061 | Medium | 6.8 | 2025-01-06 | Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process. |
CVE-2024-23366 | Medium | 6.6 | 2025-01-06 | Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size. |
CVE-2024-49088 | High | 7.8 | 2024-12-12 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2024-33056 | High | 8.4 | 2024-12-02 | Memory corruption when allocating and accessing an entry in an SMEM partition continuously. |
CVE-2024-33037 | Medium | 6.1 | 2024-12-02 | Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware. |
CVE-2024-42333 | Low | 2.7 | 2024-11-27 | The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c |
CVE-2018-5852 | High | 8.4 | 2024-11-26 | An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/i… |
CVE-2017-17772 | Critical | 9.8 | 2024-11-26 | In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation. |
CVE-2024-11596 | High | 7.8 | 2024-11-21 | ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file |
CVE-2024-49031 | High | 7.8 | 2024-11-12 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2024-9843 | Medium | 5.0 | 2024-11-12 | A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service. |
CVE-2024-38405 | High | 7.5 | 2024-11-04 | Transient DOS while processing the CU information from RNR IE. |
CVE-2024-38403 | High | 7.5 | 2024-11-04 | Transient DOS while parsing BTM ML IE when per STA profile is not included. |
CVE-2024-43595 | Medium | 6.5 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43500 | Medium | 5.5 | 2024-10-08 | Windows Resilient File System (ReFS) Information Disclosure Vulnerability |
CVE-2024-38265 | High | 8.8 | 2024-10-08 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2024-38261 | High | 7.8 | 2024-10-08 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2024-38397 | High | 7.5 | 2024-10-07 | Transient DOS while parsing probe response and assoc response frame. |
CVE-2024-33073 | High | 8.2 | 2024-10-07 | Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. |
CVE-2024-33071 | High | 7.5 | 2024-10-07 | Transient DOS while parsing the MBSSID IE from the beacons when IE length is 0. |
CVE-2024-33070 | High | 7.5 | 2024-10-07 | Transient DOS while parsing ESP IE from beacon/probe response frame. |
CVE-2024-33064 | High | 8.2 | 2024-10-07 | Information disclosure while parsing the multiple MBSSID IEs from the beacon. |
CVE-2024-33049 | High | 7.5 | 2024-10-07 | Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame. |
CVE-2024-9029 | High | 7.5 | 2024-09-27 | A flaw was found in the freeimage library. Processing a crafted image can cause a buffer over-read of 1 byte in the read_iptc_profile function in the Source/Me… |
CVE-2024-43475 | High | 7.3 | 2024-09-10 | Microsoft Windows Admin Center Information Disclosure Vulnerability |
CVE-2024-38250 | High | 7.8 | 2024-09-10 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2024-33057 | High | 7.5 | 2024-09-02 | Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location. |
CVE-2024-33051 | High | 7.5 | 2024-09-02 | Transient DOS while processing TIM IE from beacon frame as there is no check for IE length. |
CVE-2024-33050 | High | 7.5 | 2024-09-02 | Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper. |
CVE-2024-33048 | High | 7.5 | 2024-09-02 | Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame. |
CVE-2024-33047 | High | 8.4 | 2024-09-02 | Memory corruption when the captureRead QDCM command is invoked from user-space. |
CVE-2024-33043 | Medium | 5.5 | 2024-09-02 | Transient DOS while handling PS event when Program Service name length offset value is set to 255. |
CVE-2024-23364 | High | 7.5 | 2024-09-02 | Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is recei… |
CVE-2024-23359 | High | 8.2 | 2024-09-02 | Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network. |
CVE-2024-23358 | High | 7.5 | 2024-09-02 | Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem. |
CVE-2024-7347 | Medium | 4.7 | 2024-08-14 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in i… |
CVE-2024-38135 | High | 7.8 | 2024-08-13 | Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability |
CVE-2024-38127 | High | 7.8 | 2024-08-13 | Windows Hyper-V Elevation of Privilege Vulnerability |
CVE-2024-33026 | High | 7.5 | 2024-08-05 | Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp. |
CVE-2024-33025 | High | 7.5 | 2024-08-05 | Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. |
CVE-2024-33020 | High | 7.5 | 2024-08-05 | Transient DOS while processing TID-to-link mapping IE elements. |
CVE-2024-33019 | High | 7.5 | 2024-08-05 | Transient DOS while parsing the received TID-to-link mapping action frame. |
CVE-2024-33018 | High | 7.5 | 2024-08-05 | Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame. |
CVE-2024-33015 | High | 7.5 | 2024-08-05 | Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report. |
CVE-2024-33014 | High | 7.5 | 2024-08-05 | Transient DOS while parsing ESP IE from beacon/probe response frame. |
CVE-2024-33013 | High | 7.5 | 2024-08-05 | Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length. |