CWE-787 · Out-of-bounds Write (page 12)
Page 12 of 100 — CVEs classified under CWE-787, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-43250 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() The ChipIdea UDC driver can enco… |
CVE-2026-43248 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating thes… |
CVE-2026-43208 | Critical | 9.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: do not pass flow_id to set_rps_cpu() Blamed commit made the assumption that the RPS… |
CVE-2026-43206 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() func… |
CVE-2026-43205 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: validate num_ifs to prevent out-of-bounds write The driver obtains sw_attr… |
CVE-2026-43186 | Critical | 9.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __… |
CVE-2026-43166 | High | 7.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced plain identification for encoded extents Only plain data whose star… |
CVE-2026-43158 | High | 8.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both t… |
CVE-2026-43150 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: perf/arm-cmn: Reject unsupported hardware configurations So far we've been fairly lax abo… |
CVE-2026-43125 | Critical | 9.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is n… |
CVE-2026-43078 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl When page reassignmen… |
CVE-2026-43075 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline KASAN reports a use-after-free w… |
CVE-2026-28780 | Critical | 9.8 | 2026-05-05 | Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a… |
CVE-2026-36355 | High | 7.7 | 2026-05-05 | The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the wri… |
CVE-2026-25266 | Medium | 5.5 | 2026-05-04 | Memory corruption while processing IOCTL command when device is in power-save state. |
CVE-2025-47404 | Medium | 6.5 | 2026-05-04 | Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified. |
CVE-2026-7372 | Critical | 9.0 | 2026-05-04 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an… |
CVE-2026-42370 | Critical | 9.0 | 2026-05-04 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an… |
CVE-2026-42369 | Critical | 10.0 | 2026-05-04 | GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other security devices. It is a native application a… |
CVE-2026-37457 | High | 7.5 | 2026-05-01 | An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attac… |
CVE-2026-43047 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Check to ensure report responses match the request It is possible for a… |
CVE-2026-43037 | Critical | 9.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. … |
CVE-2026-43020 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provid… |
CVE-2026-31780 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation The variable valuesi… |
CVE-2026-31772 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_creat… |
CVE-2026-31748 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: comedi: me_daq: Fix potential overrun of firmware buffer `me2600_xilinx_download()` loads… |
CVE-2026-31747 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: comedi: me4000: Fix potential overrun of firmware buffer `me4000_xilinx_download()` loads… |
CVE-2026-31743 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy Buffer size used in dma allocation… |
CVE-2026-31720 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate control request size f_audio_complete() copies req->… |
CVE-2026-7582 | Medium | 5.3 | 2026-05-01 | A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev. This vulnerability affects unknown code of the file src/dds.imageio/dd… |
CVE-2026-42484 | Critical | 9.8 | 2026-05-01 | A heap-based buffer overflow in hex_to_binary in the PKZIP hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute ar… |
CVE-2026-42483 | Critical | 9.8 | 2026-05-01 | A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code v… |
CVE-2026-42482 | Critical | 9.8 | 2026-05-01 | A stack-based buffer overflow in mangle_to_hex_lower() and mangle_to_hex_upper() in src/rp_cpu.c in hashcat v7.1.2 allows an attacker to cause a denial of serv… |
CVE-2026-31716 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate rec->used in journal-replay file record check check_file_record() vali… |
CVE-2026-31712 | High | 8.3 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE size in smb_check_perm_dacl() Both ACE-walk loops in smb_check… |
CVE-2026-31707 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate response sizes in ipc_validate_msg() ipc_validate_msg() computes the expe… |
CVE-2026-31705 | Critical | 9.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte… |
CVE-2026-31699 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed When retrieving… |
CVE-2026-31698 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed When retri… |
CVE-2026-31697 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed When retrieving… |
CVE-2026-31696 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing In rxrpc_prepars… |
CVE-2026-5405 | High | 7.8 | 2026-05-01 | RDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution |
CVE-2026-5403 | High | 7.8 | 2026-05-01 | SBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution |
CVE-2026-40685 | Medium | 6.5 | 2026-04-30 | In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header… |
CVE-2026-31786 | High | 7.8 | 2026-04-30 | In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_v… |
CVE-2026-7426 | High | 8.1 | 2026-04-29 | Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent net… |
CVE-2026-41220 | High | 7.8 | 2026-04-29 | Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acro… |
CVE-2026-7354 | High | 8.8 | 2026-04-28 | Out of bounds read and write in Angle in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
CVE-2026-7323 | High | 7.3 | 2026-04-28 | Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that wit… |
CVE-2026-7322 | High | 7.3 | 2026-04-28 | Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that wit… |
CVE-2026-5435 | High | 7.3 | 2026-04-28 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, an… |
CVE-2026-31690 | High | 7.8 | 2026-04-27 | In the Linux kernel, the following vulnerability has been resolved: firmware: thead: Fix buffer overflow and use standard endian macros Addresses two issues… |
CVE-2026-6786 | High | 7.5 | 2026-04-26 | Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruptio… |
CVE-2026-6785 | High | 7.5 | 2026-04-26 | Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence… |
CVE-2026-41907 | High | 7.5 | 2026-04-24 | uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range wri… |
CVE-2026-41678 | High | 8.1 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it check… |
CVE-2026-41676 | High | 7.5 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = b… |
CVE-2026-31631 | High | 8.2 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() Fix rxgk_do_verify_authentic… |
CVE-2026-31607 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receive… |
CVE-2026-33317 | High | 8.7 | 2026-04-24 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technolog… |
CVE-2026-41990 | Medium | 4.0 | 2026-04-23 | Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data. |
CVE-2026-41989 | Medium | 6.7 | 2026-04-23 | Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt. |
CVE-2026-26354 | High | 8.1 | 2026-04-22 | Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3… |
CVE-2018-25271 | Medium | 6.2 | 2026-04-22 | Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string th… |
CVE-2018-25268 | High | 8.4 | 2026-04-22 | LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying oversized input to the… |
CVE-2018-25267 | Medium | 6.2 | 2026-04-22 | UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwr… |
CVE-2018-25266 | Medium | 6.2 | 2026-04-22 | Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an… |
CVE-2018-25265 | High | 8.4 | 2026-04-22 | LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structu… |
CVE-2018-25262 | Medium | 6.2 | 2026-04-22 | Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input t… |
CVE-2018-25261 | High | 8.4 | 2026-04-22 | Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute… |
CVE-2018-25260 | High | 8.4 | 2026-04-22 | MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute arbitrary code by exp… |
CVE-2026-31525 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN The BPF interpreter's si… |
CVE-2026-31521 | Medium | 5.5 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol st_shndx is out of bounds The module loader doesn'… |
CVE-2026-31505 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() iavf incorrectly uses real_num… |
CVE-2026-31494 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential mismatch between th… |
CVE-2026-31470 | High | 7.1 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length Validate host cont… |
CVE-2026-31452 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ext4: convert inline data to extents when truncate exceeds inline size Add a check in ext… |
CVE-2026-31432 | High | 8.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix OOB write in QUERY_INFO for compound requests When a compound request such as… |
CVE-2026-41144 | Unrated | | 2026-04-22 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to version 4.2.0, the bounds… |
CVE-2026-3298 | | 2026-04-21 | The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. T… | |
CVE-2026-6784 | High | 7.5 | 2026-04-21 | Memory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-6753 | High | 7.3 | 2026-04-21 | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-5450 | Critical | 9.8 | 2026-04-20 | Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with… |
CVE-2026-40494 | Critical | 9.8 | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 45d48d1f2e8e0d73e80bc1fd… |
CVE-2026-40493 | Critical | 9.8 | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7… |
CVE-2026-40492 | Critical | 9.8 | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 36aa5c7ec8a2bb35f6fb867a… |
CVE-2026-40489 | | 2026-04-18 | editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-base… | |
CVE-2026-27890 | High | 8.2 | 2026-04-17 | Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments dur… |
CVE-2026-6507 | High | 7.5 | 2026-04-17 | A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol… |
CVE-2026-6314 | High | 8.3 | 2026-04-15 | Out of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the GPU process to potentially perform a sand… |
CVE-2026-6305 | High | 8.8 | 2026-04-15 | Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF… |
CVE-2026-40919 | Medium | 6.1 | 2026-04-15 | A flaw was found in GIMP. This vulnerability, a buffer overflow in the `file-seattle-filmworks` plugin, can be exploited when a user opens a specially crafted… |
CVE-2026-40916 | Medium | 5.0 | 2026-04-15 | A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (… |
CVE-2026-40688 | High | 7.2 | 2026-04-14 | An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4… |
CVE-2026-27295 | High | 7.8 | 2026-04-14 | Adobe Framemaker versions 2022.8 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context… |
CVE-2026-34631 | High | 7.8 | 2026-04-14 | InCopy versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of t… |
CVE-2026-34618 | High | 7.8 | 2026-04-14 | Illustrator versions 30.2, 29.8.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context… |
CVE-2026-32203 | High | 7.5 | 2026-04-14 | Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network. |
CVE-2026-27291 | High | 7.8 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-40310 | Medium | 5.5 | 2026-04-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below both 7.1.2-19 and 6.9.13-44, contain a heap out-o… |