CWE-787 · Out-of-bounds Write (page 4)
Page 4 of 100 — CVEs classified under CWE-787, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28618 | High | 8.8 | 2026-09-08 | In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional executio… |
CVE-2026-28583 | High | 7.8 | 2026-09-08 | In validate_camera_metadata_structure of camera_metadata.c, there is a possible out of bounds write due to a logical error in the code. This could lead to loca… |
CVE-2026-78524 | High | 8.8 | 2026-09-08 | Out-of-bounds write in Microsoft Office allows an unauthorized attacker to execute code over a network. |
CVE-2026-71345 | High | 7.8 | 2026-09-08 | Out-of-bounds write in Windows Spaceport.sys allows an authorized attacker to execute code locally. |
CVE-2026-70296 | Critical | 9.8 | 2026-09-08 | Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker to execute code over a network. |
CVE-2026-69819 | Critical | 9.8 | 2026-09-08 | Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network. |
CVE-2026-82071 | High | 8.1 | 2026-09-08 | Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted paramete… |
CVE-2026-62653 | Medium | 6.8 | 2026-09-08 | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when… |
CVE-2026-62648 | High | 7.5 | 2026-09-08 | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is no… |
CVE-2026-86510 | Critical | 9.9 | 2026-09-08 | A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipula… |
CVE-2026-14297 | | 2026-09-07 | A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler allows an authentica… | |
CVE-2026-81738 | | 2026-09-07 | OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries | |
CVE-2026-86313 | High | 7.8 | 2026-09-07 | Out-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflow Buffers. This issue affects Walrus: af80e665ea49d9003695a66502f841ed1d8397e7. |
CVE-2026-0799 | High | 8.7 | 2026-09-05 | In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libp… |
CVE-2026-86098 | High | 7.4 | 2026-09-04 | ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer bo… |
CVE-2026-86095 | High | 7.8 | 2026-09-04 | Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte… |
CVE-2026-80113 | High | 7.1 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulne… |
CVE-2026-57159 | High | 7.5 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the… |
CVE-2026-17470 | Medium | 5.3 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow. |
CVE-2026-17469 | Medium | 5.3 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser. |
CVE-2026-17255 | Medium | 4.3 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of the prefix length in ICMPv6 Router Advert… |
CVE-2026-17207 | Medium | 6.5 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow. |
CVE-2026-85670 | Medium | 6.5 | 2026-09-04 | tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBuilder::build (tokenizers/src/models/bpe/model.rs). When loading a tokenizer.jso… |
CVE-2026-85452 | High | 8.8 | 2026-09-03 | MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into… |
CVE-2026-85440 | Critical | 9.8 | 2026-09-03 | MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write ar… |
CVE-2026-85437 | Critical | 9.8 | 2026-09-03 | MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without… |
CVE-2026-64197 | High | 7.8 | 2026-09-03 | There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated da… |
CVE-2026-64196 | High | 7.8 | 2026-09-03 | There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated he… |
CVE-2026-64195 | High | 7.8 | 2026-09-03 | There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-supplied data. Successful exploitation requires an attacker t… |
CVE-2026-85050 | Critical | 9.6 | 2026-09-03 | Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via… |
CVE-2026-53720 | | 2026-09-03 | pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the ca… | |
CVE-2026-84969 | Low | 3.7 | 2026-09-03 | A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a b… |
CVE-2026-6071 | | 2026-09-03 | A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an al… | |
CVE-2026-85091 | High | 7.4 | 2026-09-03 | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations… |
CVE-2026-85084 | Medium | 6.3 | 2026-09-03 | Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers. |
CVE-2026-71221 | High | 7.0 | 2026-09-03 | A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bo… |
CVE-2026-71220 | High | 7.0 | 2026-09-03 | A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index with… |
CVE-2026-84698 | Medium | 6.5 | 2026-09-02 | PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation… |
CVE-2025-12768 | | 2026-09-01 | A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve re… | |
CVE-2026-13732 | High | 7.0 | 2026-08-31 | A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code tha… |
CVE-2026-14368 | Medium | 5.4 | 2026-08-31 | The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied buffer and NUL-termi… |
CVE-2026-82680 | High | 8.8 | 2026-08-31 | A weakness has been identified in D-Link DSM-G600 1.01. This affects an unknown function of the file /load_file.cgi of the component Multipart Handler. Executi… |
CVE-2026-58106 | | 2026-08-28 | CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy() with a bounded safe_strcpy() helper. At ldlogger-to… | |
CVE-2026-18393 | Medium | 5.4 | 2026-08-28 | A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A rem… |
CVE-2026-78011 | | 2026-08-28 | An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) cond… | |
CVE-2026-78010 | | 2026-08-28 | A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service… | |
CVE-2026-78008 | | 2026-08-28 | A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of… | |
CVE-2026-19314 | | 2026-08-28 | An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) cond… | |
CVE-2026-13086 | | 2026-08-28 | A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows… | |
CVE-2026-68967 | Medium | 6.5 | 2026-08-28 | Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker to deliver a payload that could establish an arbitrary write prim… |
CVE-2026-81893 | Medium | 4.7 | 2026-08-27 | A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can lea… |
CVE-2026-76640 | High | 7.5 | 2026-08-27 | Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated p… |
CVE-2026-34620 | Medium | 5.5 | 2026-08-27 | DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker coul… |
CVE-2026-18374 | Medium | 4.9 | 2026-08-27 | Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier m… |
CVE-2026-81334 | Medium | 6.1 | 2026-08-27 | darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-… |
CVE-2026-26459 | High | 7.5 | 2026-08-27 | ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when processing malformed… |
CVE-2026-81625 | High | 8.8 | 2026-08-27 | A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overf… |
CVE-2026-19398 | | 2026-08-27 | An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BSOD) or BIOS corrupt… | |
CVE-2025-70290 | Critical | 9.8 | 2026-08-26 | An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk me… |
CVE-2026-58096 | High | 8.8 | 2026-08-26 | LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would tr… |
CVE-2026-9805 | Low | 2.7 | 2026-08-26 | SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow. |
CVE-2026-79240 | High | 8.8 | 2026-08-25 | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the s… |
CVE-2026-79189 | Critical | 9.6 | 2026-08-25 | Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
CVE-2026-79188 | Critical | 9.6 | 2026-08-25 | Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
CVE-2026-79138 | Critical | 9.6 | 2026-08-25 | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the… |
CVE-2026-79131 | Critical | 9.6 | 2026-08-25 | Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML… |
CVE-2026-79127 | High | 8.8 | 2026-08-25 | Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML… |
CVE-2026-79048 | High | 8.8 | 2026-08-25 | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the s… |
CVE-2026-79043 | Critical | 9.6 | 2026-08-25 | Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
CVE-2026-79019 | Critical | 9.6 | 2026-08-25 | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the… |
CVE-2026-78952 | High | 8.3 | 2026-08-25 | Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to exe… |
CVE-2026-68515 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3… |
CVE-2026-68514 | Medium | 5.5 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through… |
CVE-2026-68513 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 a… |
CVE-2026-75770 | High | 7.8 | 2026-08-25 | Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-75749 | High | 7.8 | 2026-08-25 | Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-71564 | High | 7.8 | 2026-08-25 | Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Ex… |
CVE-2026-71382 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-59984 | Medium | 5.5 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through… |
CVE-2026-59982 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11… |
CVE-2026-48427 | High | 7.8 | 2026-08-25 | Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Ex… |
CVE-2026-48426 | High | 7.8 | 2026-08-25 | Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Ex… |
CVE-2026-48421 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-48420 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-48419 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-48418 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-64204 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-64203 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-64202 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-64201 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-59187 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through… |
CVE-2026-59186 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3… |
CVE-2026-59184 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 t… |
CVE-2026-47626 | High | 8.2 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful explo… |
CVE-2026-24262 | High | 8.2 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful explo… |
CVE-2026-16233 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-13216 | Medium | 6.1 | 2026-08-25 | The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization. In virtio_pci_read_cap() the device-sup… |
CVE-2026-63072 | High | 7.5 | 2026-08-25 | Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can wr… |
CVE-2026-78701 | Medium | 6.5 | 2026-08-25 | A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND p… |
CVE-2026-13215 | Medium | 6.8 | 2026-08-25 | The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem. ext2_verify_disk_superbloc… |