CVE-2026-66806 | Medium | 5.5 | 2026-08-11 | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-71391 | | | 2026-08-10 | GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph… |
CVE-2026-11771 | High | 7.5 | 2026-07-30 | OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potential… |
CVE-2026-14899 | High | 7.5 | 2026-07-22 | The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a singl… |
CVE-2026-44687 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could b… |
CVE-2026-50497 | Medium | 6.5 | 2026-07-14 | Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58380 | High | 7.3 | 2026-07-06 | A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one b… |
CVE-2026-12413 | High | 7.5 | 2026-07-02 | An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The funct… |
CVE-2026-7831 | High | 7.6 | 2026-07-01 | UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the… |
CVE-2026-44042 | Low | 3.7 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:81… |
CVE-2026-58374 | Medium | 6.5 | 2026-06-30 | In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthent… |
CVE-2026-58014 | High | 7.3 | 2026-06-30 | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with a… |
CVE-2026-53309 | Critical | 9.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
The local-vs-remote re… |
CVE-2026-53306 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
tty: hvc_iucv: fix off-by-one in number of supported devices
MAX_HVC_IUCV_LINES == HVC_AL… |
CVE-2026-56790 | High | 7.3 | 2026-06-25 | CANBoat through 6.22, fixed in commit a5a22b7, contains an off-by-one global buffer overflow in the searchForPgn() function in analyzer/pgn.c that allows remot… |
CVE-2026-56787 | Medium | 6.5 | 2026-06-25 | RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode_ssr3 function at src/rtcm3.c:1446 that allows remote attackers to tr… |
CVE-2026-53263 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
6lowpan: fix off-by-one in multicast context address compression
The second memcpy in low… |
CVE-2026-52804 | | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collaborator can escalate their privileges to owner-level access by exploit… |
CVE-2026-53088 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
The write_ptr points to the next open… |
CVE-2026-53036 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Fix off-by-one in check_imm signed range check
check_imm(bits, imm) is used i… |
CVE-2026-8357 | High | 7.8 | 2026-06-15 | LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening t… |
CVE-2026-54410 | High | 8.6 | 2026-06-14 | nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated a… |
CVE-2026-46559 | Medium | 4.0 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in… |
CVE-2026-45380 | Low | 3.6 | 2026-06-10 | bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, a one-byte off-by-one error in S… |
CVE-2026-45358 | Medium | 5.3 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the m… |
CVE-2026-52907 | High | 7.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved:
media: rockchip: rkcif: fix off by one bugs
Change these comparisons from > vs >= to avoi… |
CVE-2026-49127 | High | 8.6 | 2026-05-28 | Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows… |
CVE-2026-46066 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
ceph: fix num_ops off-by-one when crypto allocation fails
move_dirty_folio_in_page_array(… |
CVE-2026-42015 | Medium | 5.3 | 2026-05-26 | A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the… |
CVE-2026-48689 | Critical | 9.8 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hp… |
CVE-2026-44065 | Medium | 4.2 | 2026-05-21 | An off-by-two error in lp_write() in papd in Netatalk 2.0.0 through 4.4.2 allows an adjacent network attacker to modify limited data or cause a minor service d… |
CVE-2026-45232 | Low | 3.1 | 2026-05-20 | Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows… |
CVE-2026-44603 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007. |
CVE-2026-7572 | Medium | 4.4 | 2026-05-06 | An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux a… |
CVE-2026-43964 | Low | 3.7 | 2026-05-04 | Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks t… |
CVE-2026-43860 | Low | 3.7 | 2026-05-04 | mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest. |
CVE-2026-41502 | High | 7.5 | 2026-04-24 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an off-by-one out-of-bounds read vulnerability in bacnet-st… |
CVE-2026-40254 | Medium | 4.2 | 2026-04-24 | FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/drive/cl… |
CVE-2026-6861 | Medium | 6.1 | 2026-04-22 | A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG (Scalable Vector Graphics) CSS… |
CVE-2026-40312 | Medium | 6.2 | 2026-04-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, an off by one error in the MSL decod… |
CVE-2026-32605 | High | 7.5 | 2026-04-13 | nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an un… |
CVE-2026-33997 | Medium | 6.8 | 2026-03-31 | Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be… |
CVE-2026-5123 | Low | 3.7 | 2026-03-30 | A weakness has been identified in osrg GoBGP up to 4.3.0. This impacts the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go. Executing a manipulation… |
CVE-2026-22593 | High | 8.4 | 2026-03-26 | EVerest is an EV charging software stack. Prior to version 2026.02.0, an off-by-one check in IsoMux certificate filename handling causes a stack-based buffer o… |
CVE-2026-4887 | Medium | 6.1 | 2026-03-26 | A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by con… |
CVE-2026-34085 | Medium | 5.9 | 2026-03-25 | fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a cr… |
CVE-2006-10003 | Critical | 9.8 | 2026-03-19 | XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.
In the case (stackptr == stacksize - 1), the stack will… |
CVE-2026-23257 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved:
net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
In setup_nic_device… |
CVE-2026-23256 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved:
net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
In setup_nic_device… |
CVE-2026-28520 | High | 8.4 | 2026-03-16 | arduino-TuyaOpen before version 1.2.1 contains a single-byte buffer overflow vulnerability in the WiFiMulti component. When the victim's smart hardware connect… |
CVE-2026-31988 | Medium | 5.3 | 2026-03-11 | yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLa… |
CVE-2026-26309 | Medium | 5.3 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscaper::escapeString()… |
CVE-2026-25989 | High | 7.5 | 2026-02-24 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can… |
CVE-2026-2703 | Low | 3.3 | 2026-02-19 | A weakness has been identified in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::decode_base64 of the file source/detail/cryptography/… |
CVE-2026-21870 | Medium | 5.5 | 2026-02-13 | BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services. In 1.4.2, 1.5.0.rc2, and… |
CVE-2025-71161 | High | 7.5 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved:
dm-verity: disable recursive forward error correction
There are two problems with the rec… |
CVE-2026-23951 | Medium | 5.5 | 2026-01-22 | SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, cau… |
CVE-2025-71087 | Medium | 5.5 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved:
iavf: fix off-by-one issues in iavf_config_rss_reg()
There are off-by-one bugs when confi… |
CVE-2026-21504 | Medium | 6.6 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21494 | Medium | 6.1 | 2026-01-06 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21491 | Medium | 6.1 | 2026-01-06 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21490 | Medium | 6.1 | 2026-01-06 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2025-11215 | Medium | 4.3 | 2025-11-06 | Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chro… |
CVE-2022-50428 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved:
ext4: fix off-by-one errors in fast-commit block filling
Due to several different off-by-… |
CVE-2025-4582 | High | 7.1 | 2025-09-23 | Buffer Over-read, Off-by-one Error vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation, Overread Buffers.This issue affects Con… |
CVE-2023-53397 | Medium | 5.5 | 2025-09-18 | In the Linux kernel, the following vulnerability has been resolved:
modpost: fix off by one in is_executable_section()
The > comparison should be >= to preve… |
CVE-2025-38600 | High | 8.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()
The ssid->ssids[] and sreq->ss… |
CVE-2025-54349 | Medium | 6.5 | 2025-08-03 | In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. |
CVE-2025-53014 | Low | 3.7 | 2025-07-14 | ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overf… |
CVE-2025-52497 | Medium | 4.8 | 2025-07-04 | Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM… |
CVE-2025-47711 | Medium | 6.5 | 2025-06-09 | There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a ve… |
CVE-2023-53143 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved:
ext4: fix another off-by-one fsmap error on 1k block filesystems
Apparently syzbot figure… |
CVE-2025-23150 | High | 7.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved:
ext4: fix off-by-one error in do_split
Syzkaller detected a use-after-free issue in ext4_… |
CVE-2025-43973 | Medium | 6.8 | 2025-04-21 | An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are a… |
CVE-2025-43971 | High | 8.6 | 2025-04-21 | An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen. |
CVE-2025-37893 | High | 7.8 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Fix off-by-one error in build_prologue()
Vincent reported that running BP… |
CVE-2025-30742 | Medium | 5.3 | 2025-03-26 | httpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not have a final '\0' cha… |
CVE-2024-10442 | Critical | 10.0 | 2025-03-19 | Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified… |
CVE-2025-21813 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved:
timers/migration: Fix off-by-one root mis-connection
Before attaching a new root to the o… |
CVE-2024-57990 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
This comparison should be >= inst… |
CVE-2022-49365 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq()
The > ARRAY_SIZE() should be >= ARRAY… |
CVE-2022-49077 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved:
mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
If an mremap… |
CVE-2024-57259 | High | 7.1 | 2025-02-18 | sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the p… |
CVE-2024-48854 | Medium | 5.3 | 2025-01-14 | Off-by-one error in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the… |
CVE-2024-56720 | High | 7.8 | 2024-12-29 | In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Several fixes to bpf_msg_pop_data
Several fixes to bpf_msg_pop_data,
1. In… |
CVE-2024-56663 | High | 7.8 | 2024-12-27 | In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
Since the netlink attribute range… |
CVE-2024-53163 | Medium | 5.5 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved:
crypto: qat/qat_420xx - fix off by one in uof_get_name()
This is called from uof_get_name… |
CVE-2024-53149 | Medium | 4.6 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: glink: fix off-by-one in connector_status
UCSI connector's indices star… |
CVE-2024-51554 | Critical | 9.1 | 2024-12-05 | Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.
Affected products:
ABB ASPE… |
CVE-2024-49880 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
ext4: fix off by one issue in alloc_flex_gd()
Wesley reported an issue:
================… |
CVE-2024-49862 | High | 7.1 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
powercap: intel_rapl: Fix off by one in get_rpi()
The rp->priv->rpi array is either rpi_m… |
CVE-2024-47686 | High | 7.1 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
The psc->div[] array has psc->n… |
CVE-2024-47682 | High | 8.6 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
scsi: sd: Fix off-by-one error in sd_read_block_characteristics()
Ff the device returns p… |
CVE-2024-45796 | Medium | 5.3 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error dur… |
CVE-2024-46852 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved:
dma-buf: heaps: Fix off-by-one in CMA heap fault handler
Until VM_DONTEXPAND was added in… |
CVE-2024-32668 | High | 8.2 | 2024-09-05 | An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller.
A malicious, privile… |
CVE-2024-43852 | High | 7.8 | 2024-08-17 | In the Linux kernel, the following vulnerability has been resolved:
hwmon: (ltc2991) re-order conditions to fix off by one bug
LTC2991_T_INT_CH_NR is 4. The… |
CVE-2024-36136 | High | 7.5 | 2024-08-14 | An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS. |
CVE-2022-48732 | High | 7.8 | 2024-06-20 | In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: fix off by one in BIOS boundary checking
Bounds checking when parsing init s… |
CVE-2024-38441 | Critical | 9.8 | 2024-06-16 | Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/… |