CWE-787 · Out-of-bounds Write (page 2)
Page 2 of 100 — CVEs classified under CWE-787, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-101203 | Medium | 6.3 | 2026-09-28 | A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the component 1bpp RLE Decoder. The manipula… |
CVE-2026-101202 | Medium | 6.3 | 2026-09-28 | A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component TGA Image Handler. Executing a manipula… |
CVE-2026-18415 | Medium | 6.3 | 2026-09-28 | ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame_buf_pool, sized IE… |
CVE-2026-18414 | High | 7.8 | 2026-09-28 | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/z… |
CVE-2026-18413 | High | 7.8 | 2026-09-28 | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/z… |
CVE-2026-16513 | High | 7.8 | 2026-09-28 | The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO obje… |
CVE-2026-86950 | High | 8.8 | 2026-09-28 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Taho… |
CVE-2026-102004 | High | 7.8 | 2026-09-28 | Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26… |
CVE-2026-100888 | High | 7.3 | 2026-09-28 | A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. This affects the function dkim_canon_selecthdrs of the file libopendkim/dkim-ca… |
CVE-2026-100740 | Critical | 9.9 | 2026-09-27 | A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channe… |
CVE-2026-100504 | High | 7.0 | 2026-09-26 | Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift… |
CVE-2026-80431 | | 2026-09-25 | Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to writ… | |
CVE-2026-87118 | Medium | 5.7 | 2026-09-24 | The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticated attacker with ad… |
CVE-2026-88390 | High | 7.7 | 2026-09-24 | An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input containing an overlong tok… |
CVE-2026-88378 | Critical | 9.8 | 2026-09-24 | QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag(). |
CVE-2026-96746 | Medium | 6.5 | 2026-09-24 | An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the respo… |
CVE-2026-13467 | High | 8.1 | 2026-09-24 | Out-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue… |
CVE-2026-97185 | High | 7.8 | 2026-09-24 | A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing… |
CVE-2026-96891 | Critical | 9.8 | 2026-09-24 | A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipul… |
CVE-2026-88839 | Medium | 6.7 | 2026-09-23 | BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. |
CVE-2026-88832 | High | 7.3 | 2026-09-23 | BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images. |
CVE-2026-91815 | High | 7.8 | 2026-09-23 | Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap… |
CVE-2026-91811 | High | 7.8 | 2026-09-23 | A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fa… |
CVE-2026-91804 | High | 7.8 | 2026-09-23 | A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in… |
CVE-2026-91802 | High | 7.8 | 2026-09-23 | A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buf… |
CVE-2026-91794 | High | 7.8 | 2026-09-23 | An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation whe… |
CVE-2026-91789 | High | 7.8 | 2026-09-23 | Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and related size information. Under certain condi… |
CVE-2026-18095 | High | 8.5 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow. |
CVE-2026-17636 | High | 8.8 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation o… |
CVE-2026-87121 | Critical | 9.8 | 2026-09-22 | lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device. |
CVE-2026-95862 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of S… |
CVE-2026-83963 | High | 7.8 | 2026-09-22 | Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-81998 | High | 7.8 | 2026-09-22 | Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-79906 | High | 7.8 | 2026-09-22 | Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-77555 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of S… |
CVE-2026-77544 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of S… |
CVE-2026-75663 | High | 7.8 | 2026-09-22 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-75658 | High | 7.8 | 2026-09-22 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-18460 | | 2026-09-22 | Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Profession… | |
CVE-2026-83601 | Medium | 6.5 | 2026-09-22 | Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded pas… |
CVE-2026-81878 | Medium | 5.5 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable be… |
CVE-2026-63276 | | 2026-09-22 | LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents… | |
CVE-2026-63275 | | 2026-09-22 | LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was… | |
CVE-2026-63274 | | 2026-09-22 | LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's… | |
CVE-2026-63273 | | 2026-09-22 | LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from… | |
CVE-2026-63272 | | 2026-09-22 | LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own chara… | |
CVE-2026-95508 | High | 7.4 | 2026-09-22 | A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-su… |
CVE-2026-88407 | High | 7.5 | 2026-09-21 | An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial o… |
CVE-2026-17052 | High | 7.8 | 2026-09-21 | The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port devi… |
CVE-2026-92382 | Medium | 4.1 | 2026-09-21 | An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer per… |
CVE-2026-61674 | | 2026-09-21 | Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forwa… | |
CVE-2026-17051 | Medium | 6.0 | 2026-09-21 | The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the peer-wri… |
CVE-2026-94054 | High | 7.0 | 2026-09-19 | Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write. |
CVE-2026-93894 | | 2026-09-18 | In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a r… | |
CVE-2026-61714 | High | 7.8 | 2026-09-18 | FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI… |
CVE-2026-75892 | Medium | 6.5 | 2026-09-18 | In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memor… |
CVE-2026-77396 | | 2026-09-18 | PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c us… | |
CVE-2026-91142 | Low | 3.6 | 2026-09-18 | A flaw was found in Cockpit. An integer overflow vulnerability in the `do_lastlog()` function, specifically in the offset calculation for `lastlog` entries on… |
CVE-2026-84444 | High | 7.4 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an… |
CVE-2026-84383 | Critical | 9.8 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl refer… |
CVE-2026-67549 | High | 7.6 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted… |
CVE-2026-63638 | High | 8.3 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-63422 | High | 7.8 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-63419 | High | 7.8 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-59181 | Medium | 6.1 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0… |
CVE-2026-10027 | High | 8.1 | 2026-09-18 | IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data… |
CVE-2026-81627 | High | 8.2 | 2026-09-18 | A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A pr… |
CVE-2026-15579 | | 2026-09-18 | An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login proce… | |
CVE-2026-93452 | High | 7.5 | 2026-09-18 | snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination bu… |
CVE-2026-93451 | Medium | 6.5 | 2026-09-18 | snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompre… |
CVE-2026-73639 | Critical | 9.1 | 2026-09-17 | Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8. … |
CVE-2026-54634 | High | 7.3 | 2026-09-17 | Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reach… |
CVE-2026-93393 | High | 8.1 | 2026-09-17 | A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that… |
CVE-2026-54692 | High | 7.8 | 2026-09-17 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sail_codec_load_frame_v8… |
CVE-2026-54627 | Critical | 9.8 | 2026-09-17 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psd_private_sail_… |
CVE-2026-54626 | Critical | 9.8 | 2026-09-17 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_R… |
CVE-2026-93015 | Medium | 6.3 | 2026-09-17 | BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can… |
CVE-2026-92880 | Medium | 6.3 | 2026-09-17 | A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component… |
CVE-2026-25280 | High | 7.8 | 2026-09-17 | Memory corruption when processing escape handling flow with insufficient user buffer sizes. |
CVE-2026-24074 | High | 7.8 | 2026-09-17 | Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations. |
CVE-2026-24073 | High | 7.8 | 2026-09-17 | Memory corruption when processing decode statistics due to insufficient validation of offset against structure size. |
CVE-2026-92786 | High | 7.8 | 2026-09-16 | LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP pr… |
CVE-2026-91097 | Critical | 9.8 | 2026-09-16 | HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentia… |
CVE-2026-86107 | Medium | 5.9 | 2026-09-16 | The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This… |
CVE-2026-91711 | High | 8.8 | 2026-09-15 | Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a craft… |
CVE-2026-92179 | High | 7.8 | 2026-09-15 | pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-92177 | High | 7.8 | 2026-09-15 | pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-58773 | Medium | 6.7 | 2026-09-15 | In link_load_gnss_image of link_device.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privile… |
CVE-2026-58734 | High | 7.0 | 2026-09-15 | In google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege… |
CVE-2026-58701 | High | 7.0 | 2026-09-15 | In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege wi… |
CVE-2026-58683 | High | 8.8 | 2026-09-15 | In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation. This could lead to remote code execution with no addition… |
CVE-2026-57035 | Medium | 6.7 | 2026-09-15 | In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System exec… |
CVE-2026-57014 | High | 7.8 | 2026-09-15 | In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local… |
CVE-2026-56997 | High | 8.8 | 2026-09-15 | In Av1DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privi… |
CVE-2026-56989 | Medium | 6.7 | 2026-09-15 | In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System exec… |
CVE-2026-56974 | High | 8.8 | 2026-09-15 | In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds write due to improper input validation. This could lead to remote code execution… |
CVE-2026-56972 | Medium | 6.7 | 2026-09-15 | In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System e… |
CVE-2026-56945 | High | 7.8 | 2026-09-15 | In VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additional execution privile… |
CVE-2026-56942 | High | 8.8 | 2026-09-15 | In ReadTileInfo of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege… |
CVE-2026-56920 | High | 8.8 | 2026-09-15 | In s_decode_vui_param of fw_hevc_dec_header.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code executi… |