CWE-193 · Off-by-one Error (page 2)
Page 2 of 3 — CVEs classified under CWE-193, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-21813 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fix off-by-one root mis-connection Before attaching a new root to the o… |
CVE-2024-57990 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() This comparison should be >= inst… |
CVE-2022-49365 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq() The > ARRAY_SIZE() should be >= ARRAY… |
CVE-2022-49077 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) If an mremap… |
CVE-2024-57259 | High | 7.1 | 2025-02-18 | sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the p… |
CVE-2024-48854 | Medium | 5.3 | 2025-01-14 | Off-by-one error in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the… |
CVE-2024-56720 | High | 7.8 | 2024-12-29 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Several fixes to bpf_msg_pop_data Several fixes to bpf_msg_pop_data, 1. In… |
CVE-2024-56663 | High | 7.8 | 2024-12-27 | In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one Since the netlink attribute range… |
CVE-2024-53163 | Medium | 5.5 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat/qat_420xx - fix off by one in uof_get_name() This is called from uof_get_name… |
CVE-2024-53149 | Medium | 4.6 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix off-by-one in connector_status UCSI connector's indices star… |
CVE-2024-51554 | Critical | 9.1 | 2024-12-05 | Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPE… |
CVE-2024-49880 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix off by one issue in alloc_flex_gd() Wesley reported an issue: ================… |
CVE-2024-49862 | High | 7.1 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: powercap: intel_rapl: Fix off by one in get_rpi() The rp->priv->rpi array is either rpi_m… |
CVE-2024-47686 | High | 7.1 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate() The psc->div[] array has psc->n… |
CVE-2024-47682 | High | 8.6 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix off-by-one error in sd_read_block_characteristics() Ff the device returns p… |
CVE-2024-45796 | Medium | 5.3 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error dur… |
CVE-2024-46852 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VM_DONTEXPAND was added in… |
CVE-2024-32668 | High | 8.2 | 2024-09-05 | An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. A malicious, privile… |
CVE-2024-43852 | High | 7.8 | 2024-08-17 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc2991) re-order conditions to fix off by one bug LTC2991_T_INT_CH_NR is 4. The… |
CVE-2024-36136 | High | 7.5 | 2024-08-14 | An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS. |
CVE-2022-48732 | High | 7.8 | 2024-06-20 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix off by one in BIOS boundary checking Bounds checking when parsing init s… |
CVE-2024-38441 | Critical | 9.8 | 2024-06-16 | Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/… |
CVE-2024-38440 | High | 7.5 | 2024-06-16 | Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in… |
CVE-2024-36957 | Medium | 5.5 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one read from userspace We try to access count + 1 byte from u… |
CVE-2024-36025 | Medium | 5.5 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() The app_reply->elem[] array is a… |
CVE-2021-47373 | Medium | 5.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Fix potential VPE leak on error In its_vpe_irq_domain_alloc, when its… |
CVE-2022-48672 | High | 7.8 | 2024-05-03 | In the Linux kernel, the following vulnerability has been resolved: of: fdt: fix off-by-one error in unflatten_dt_nodes() Commit 78c44d910d3e ("drivers/of: F… |
CVE-2023-44444 | High | 7.8 | 2024-05-03 | GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installa… |
CVE-2024-26995 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Correct the PDO counting in pd_set Off-by-one errors happen because nr_… |
CVE-2024-31585 | Medium | 5.3 | 2024-04-17 | FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers… |
CVE-2024-26766 | High | 7.8 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Unfortunately the commit `fd8958efe877… |
CVE-2024-1441 | Medium | 5.5 | 2024-03-11 | An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array… |
CVE-2021-47046 | High | 7.8 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix off by one in hdmi_14_process_transaction() The hdcp_i2c_offsets[] a… |
CVE-2024-23849 | Medium | 5.5 | 2024-01-23 | In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, res… |
CVE-2023-46247 | High | 7.5 | 2023-12-13 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots t… |
CVE-2023-46853 | Critical | 9.8 | 2023-10-27 | In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n. |
CVE-2023-4260 | Medium | 6.3 | 2023-09-27 | Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. |
CVE-2023-4259 | High | 7.1 | 2023-09-26 | Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code. |
CVE-2023-41880 | Low | 2.2 | 2023-09-15 | Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssemb… |
CVE-2022-33064 | High | 7.8 | 2023-07-18 | An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrar… |
CVE-2023-38429 | Critical | 9.8 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbd_smb2_ch… |
CVE-2023-28709 | High | 7.5 | 2023-05-22 | The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTT… |
CVE-2023-30546 | Critical | 9.8 | 2023-04-26 | Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope database management system in the Contik… |
CVE-2023-28858 | Low | 3.7 | 2023-03-26 | redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an un… |
CVE-2023-27477 | Low | 3.1 | 2023-03-08 | wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16… |
CVE-2023-0818 | Medium | 5.5 | 2023-02-13 | Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV. |
CVE-2022-34684 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an off-by-one error may lead to data tampering or info… |
CVE-2022-36354 | Medium | 5.3 | 2022-12-22 | A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-… |
CVE-2022-47517 | High | 7.5 | 2022-12-18 | An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a… |
CVE-2022-41916 | Medium | 5.9 | 2022-11-15 | Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI cer… |
CVE-2022-3821 | Medium | 5.5 | 2022-11-08 | An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accurac… |
CVE-2022-3872 | High | 8.6 | 2022-11-07 | An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and s… |
CVE-2021-46848 | Critical | 9.1 | 2022-10-24 | GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der. |
CVE-2022-39274 | High | 7.5 | 2022-10-06 | LoRaMac-node is a reference implementation and documentation of a LoRa network node. Versions of LoRaMac-node prior to 4.7.0 are vulnerable to a buffer overflo… |
CVE-2022-3103 | High | 7.8 | 2022-09-26 | off-by-one in io_uring module. |
CVE-2021-3999 | High | 7.8 | 2022-08-24 | A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A lo… |
CVE-2020-27793 | High | 7.5 | 2022-08-19 | An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c. This could allow an attacker to cause a crash, and perform a de… |
CVE-2022-34970 | Critical | 9.8 | 2022-08-04 | Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers… |
CVE-2022-30155 | Medium | 5.5 | 2022-06-15 | Windows Kernel Denial of Service Vulnerability |
CVE-2022-23400 | High | 7.1 | 2022-05-03 | A stack-based buffer overflow vulnerability exists in the IGXMPXMLParser::parseDelimiter functionality of Accusoft ImageGear 19.10. A specially-crafted PSD fil… |
CVE-2021-21938 | Critical | 9.8 | 2022-04-14 | A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to cod… |
CVE-2022-25051 | Medium | 5.5 | 2022-03-02 | An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file. |
CVE-2021-4070 | Critical | 9.1 | 2022-02-23 | Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0. |
CVE-2021-3930 | Medium | 6.5 | 2022-02-18 | An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' arg… |
CVE-2022-24988 | Critical | 9.8 | 2022-02-14 | In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector. |
CVE-2021-44007 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an o… |
CVE-2021-23017 | High | 7.7 | 2021-06-01 | A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory ov… |
CVE-2021-29529 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in `tf.raw_ops.QuantizedResizeBilinear` b… |
CVE-2021-31875 | Critical | 9.8 | 2021-04-29 | In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which ca… |
CVE-2020-27171 | Medium | 6.0 | 2021-03-20 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-… |
CVE-2021-3156 | High | 7.8 | 2021-01-26 | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" a… |
CVE-2020-35893 | High | 7.5 | 2020-12-31 | An issue was discovered in the simple-slab crate before 0.3.3 for Rust. remove() has an off-by-one error, causing memory leakage and a drop of uninitialized me… |
CVE-2020-29040 | High | 8.8 | 2020-11-24 | An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to cause a denial of service (stack corruption), cause a data leak, or possibly g… |
CVE-2020-14510 | Critical | 9.8 | 2020-08-25 | GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as… |
CVE-2020-14508 | High | 8.1 | 2020-08-25 | GateManager versions prior to 9.2c, The affected product is vulnerable to an off-by-one error, which may allow an attacker to remotely execute arbitrary code o… |
CVE-2020-3969 | High | 7.8 | 2020-06-24 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and F… |
CVE-2020-10062 | Critical | 9.0 | 2020-06-05 | An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue… |
CVE-2019-19721 | High | 7.8 | 2020-05-15 | An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of ser… |
CVE-2019-12521 | Medium | 5.9 | 2020-04-15 | An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a st… |
CVE-2020-11765 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, le… |
CVE-2020-3840 | High | 7.8 | 2020-02-27 | An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. This issue is fixed in iO… |
CVE-2020-8443 | Critical | 9.8 | 2020-01-30 | In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to an off-by-one heap-based buffer overflow… |
CVE-2020-7044 | High | 7.5 | 2020-01-16 | In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash. This was addressed in epan/dissectors/packet-wassp.c by using >= and <= to resolve off-by-one… |
CVE-2020-6835 | Critical | 9.8 | 2020-01-10 | An issue was discovered in Bftpd before 5.4. There is a heap-based off-by-one error during file-transfer error checking. |
CVE-2014-8182 | High | 7.5 | 2020-01-02 | An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an a… |
CVE-2019-19906 | High | 7.5 | 2019-12-19 | cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The… |
CVE-2015-0841 | High | 7.5 | 2019-12-09 | Off-by-one error in the readBuf function in listener.cpp in libcapsinetwork and monopd before 0.9.8, allows remote attackers to cause a denial of service (cras… |
CVE-2019-18423 | High | 8.8 | 2019-10-31 | An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall. p2m->max_mapped_g… |
CVE-2019-14532 | Critical | 9.8 | 2019-08-02 | An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus ha… |
CVE-2019-14323 | High | 7.5 | 2019-07-28 | SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server… |
CVE-2010-5331 | High | 7.8 | 2019-07-27 | In the Linux kernel before 2.6.34, a range check issue in drivers/gpu/drm/radeon/atombios.c could cause an off by one (buffer overflow) problem. NOTE: At least… |
CVE-2019-13306 | High | 7.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors. |
CVE-2019-13305 | High | 7.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error. |
CVE-2019-10131 | High | 7.1 | 2019-04-30 | An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker… |
CVE-2019-8272 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution. This attack appears to be ex… |
CVE-2019-8268 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadString function, which… |
CVE-2019-9209 | Medium | 5.5 | 2019-02-28 | In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preven… |
CVE-2019-3813 | High | 7.5 | 2019-02-04 | Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of serv… |
CVE-2018-5800 | Medium | 6.5 | 2018-12-07 | An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.7 can be exploited to cau… |
CVE-2018-14599 | Critical | 9.8 | 2018-08-24 | An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server resp… |