CWE-787 · Out-of-bounds Write (page 4)
Page 4 of 100 — CVEs classified under CWE-787, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20458 | High | 7.5 | 2026-07-01 | In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a ro… |
CVE-2026-14191 | High | 7.8 | 2026-07-01 | An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector… |
CVE-2026-54900 | | 2026-07-01 | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj… | |
CVE-2026-54592 | High | 7.5 | 2026-07-01 | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child, when invoked recursively ov… |
CVE-2026-54696 | Low | 3.7 | 2026-06-30 | Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an o… |
CVE-2026-14152 | Critical | 9.6 | 2026-06-30 | Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-14087 | High | 8.8 | 2026-06-30 | Heap buffer overflow in WebNN in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentia… |
CVE-2026-14063 | Medium | 5.7 | 2026-06-30 | Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memo… |
CVE-2026-13873 | Medium | 6.5 | 2026-06-30 | Out of bounds read in Layout in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-14241 | Critical | 9.8 | 2026-06-30 | Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these cou… |
CVE-2026-43745 | Medium | 6.5 | 2026-06-29 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-43712 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visio… |
CVE-2026-43703 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Ta… |
CVE-2026-43676 | Medium | 6.5 | 2026-06-29 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-28979 | Medium | 6.5 | 2026-06-29 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-13592 | High | 7.3 | 2026-06-29 | A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWriter::append of… |
CVE-2026-9105 | Medium | 6.5 | 2026-06-29 | An authenticated stack-based buffer overflow vulnerability exists in the web management interface of TP-Link TL-WR841N v14. A remote authenticated attacker ca… |
CVE-2026-10644 | Medium | 4.2 | 2026-06-28 | The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mchp_sercom_g1.c), used by the PIC32CM-JH SoC family, contains an out-of-bounds write in its asynchron… |
CVE-2026-58049 | High | 8.6 | 2026-06-28 | FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and v… |
CVE-2026-10643 | High | 8.7 | 2026-06-28 | Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffe… |
CVE-2026-45258 | High | 7.8 | 2026-06-27 | dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could over… |
CVE-2026-46604 | High | 7.5 | 2026-06-26 | The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset. |
CVE-2026-57876 | High | 7.5 | 2026-06-26 | An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused… |
CVE-2026-6325 | High | 7.5 | 2026-06-25 | Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write past the bounds of the destination buffer. |
CVE-2026-6681 | Medium | 5.3 | 2026-06-25 | The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of the provided buffer… |
CVE-2026-6679 | High | 7.5 | 2026-06-25 | A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an intege… |
CVE-2026-55958 | High | 7.5 | 2026-06-25 | Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsip_StoreMessage() the capacity check guarding the fixed message bag (MSGBAG_SIZE) sets… |
CVE-2026-56786 | Critical | 9.8 | 2026-06-25 | RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size… |
CVE-2026-49839 | High | 7.1 | 2026-06-25 | jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-b… |
CVE-2026-57455 | High | 7.8 | 2026-06-25 | Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a… |
CVE-2026-55892 | Medium | 5.5 | 2026-06-25 | Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with… |
CVE-2026-55693 | High | 7.8 | 2026-06-25 | Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spel… |
CVE-2026-12844 | High | 7.5 | 2026-06-25 | List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by the block i… |
CVE-2026-47151 | High | 7.1 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location… |
CVE-2026-47150 | High | 7.1 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and… |
CVE-2026-53246 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening S… |
CVE-2026-53209 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising… |
CVE-2026-53205 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write… |
CVE-2026-53203 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow check in MS get_info_ioctl Add validation that the info s… |
CVE-2026-53202 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow wh… |
CVE-2026-53196 | Medium | 6.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_… |
CVE-2026-53195 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() build_i2c_fw_hdr() allocates… |
CVE-2026-53194 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: kl5kusb105: fix bulk-out buffer overflow klsi_105_prepare_write_buffer() is… |
CVE-2026-53187 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc The cpu_id attribute supplied… |
CVE-2026-53173 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() The command strea… |
CVE-2026-53148 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_reques… |
CVE-2026-53143 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD man… |
CVE-2026-53137 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size [Why & How] During HDCP… |
CVE-2026-53136 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size [Why & How] The VB… |
CVE-2026-13033 | High | 8.8 | 2026-06-24 | Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted… |
CVE-2026-53059 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_co… |
CVE-2026-53043 | Critical | 9.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two… |
CVE-2026-53041 | High | 7.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix listxattr handling when the buffer is full [BUG] If an OCFS2 inode has both in… |
CVE-2026-53016 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-ccp requests pass an 8… |
CVE-2026-53004 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks sctp_getsockopt_peer… |
CVE-2026-53002 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes ar… |
CVE-2026-52992 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: fs/adfs: validate nzones in adfs_validate_bblk() Reject ADFS disc records with a zero zon… |
CVE-2026-52962 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix a buffer leak in __ceph_setxattr() The old_blob in __ceph_setxattr() can store … |
CVE-2026-52935 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: do not reuse an in-progress partial send espintcp keeps a single in-fligh… |
CVE-2026-52914 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload… |
CVE-2020-9695 | High | 7.8 | 2026-06-23 | Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier are affected by an out-of-bounds write vulnerability that co… |
CVE-2026-56114 | Medium | 5.3 | 2026-06-23 | dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows u… |
CVE-2026-10658 | High | 7.1 | 2026-06-23 | bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from… |
CVE-2026-56340 | High | 8.8 | 2026-06-20 | vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant… |
CVE-2026-49295 | High | 7.1 | 2026-06-19 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write i… |
CVE-2026-48773 | Critical | 9.8 | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerabilit… |
CVE-2026-56211 | High | 7.1 | 2026-06-19 | A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Sca… |
CVE-2026-56209 | High | 7.1 | 2026-06-19 | An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding)… |
CVE-2026-44663 | Medium | 6.1 | 2026-06-18 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.1… |
CVE-2026-8461 | High | 8.8 | 2026-06-18 | An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be… |
CVE-2026-39199 | Low | 2.9 | 2026-06-17 | snes9x 1.63 allows an out-of-bounds write and denial of service via a crafted .ups file. |
CVE-2026-2674 | High | 8.1 | 2026-06-17 | Out-of-bounds Write, Out-of-bounds Write, Out-of-bounds Write vulnerability in RTI Connext Professional (Queueing Service,Core Libraries,Persistence Service) a… |
CVE-2026-42055 | High | 8.1 | 2026-06-17 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the prox… |
CVE-2026-12528 | Medium | 5.4 | 2026-06-17 | A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trig… |
CVE-2026-10641 | High | 7.1 | 2026-06-17 | Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) contains an out-of-bounds write. During Ser… |
CVE-2026-47750 | High | 7.8 | 2026-06-16 | stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. In versions pr… |
CVE-2026-47747 | High | 7.8 | 2026-06-16 | stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. In versions pr… |
CVE-2026-0164 | High | 8.8 | 2026-06-16 | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileg… |
CVE-2026-0161 | High | 8.8 | 2026-06-16 | In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privileg… |
CVE-2026-0153 | High | 7.8 | 2026-06-16 | In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege w… |
CVE-2026-0151 | High | 8.8 | 2026-06-16 | In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additio… |
CVE-2026-0150 | High | 7.8 | 2026-06-16 | In ExecuteGraph command handler of EdgeTPU firmware, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of… |
CVE-2026-0149 | High | 8.8 | 2026-06-16 | In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional exec… |
CVE-2026-0148 | High | 8.8 | 2026-06-16 | In multiple functions of VideoRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code exe… |
CVE-2026-0147 | High | 8.8 | 2026-06-16 | In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out of bounds write due to a missing bounds check. This could lead to rem… |
CVE-2026-0146 | High | 8.8 | 2026-06-16 | In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote co… |
CVE-2026-0138 | High | 7.8 | 2026-06-16 | In lwis_io_buffer_write of lwis_io_buffer.c, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege… |
CVE-2026-0126 | Critical | 9.8 | 2026-06-16 | In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privi… |
CVE-2026-47749 | High | 7.8 | 2026-06-16 | stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior… |
CVE-2026-12314 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12310 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12298 | Medium | 5.4 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12292 | High | 8.1 | 2026-06-16 | Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140… |
CVE-2026-46331 | High | 7.8 | 2026-06-16 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() compute… |
CVE-2026-8358 | | 2026-06-15 | LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for t… | |
CVE-2026-8357 | High | 7.8 | 2026-06-15 | LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening t… |
CVE-2026-8356 | | 2026-06-15 | LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-siz… | |
CVE-2026-6047 | | 2026-06-15 | LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A han… | |
CVE-2026-6045 | | 2026-06-15 | LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of g… | |
CVE-2026-6040 | High | 7.3 | 2026-06-15 | A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked agains… |