CWE-787 · Out-of-bounds Write (page 7)
Page 7 of 100 — CVEs classified under CWE-787, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18220 | High | 7.8 | 2026-07-29 | An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps E… |
CVE-2026-58188 | High | 8.2 | 2026-07-29 | Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through… |
CVE-2026-58187 | Low | 3.7 | 2026-07-29 | The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traff… |
CVE-2026-58184 | High | 8.2 | 2026-07-29 | The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache… |
CVE-2026-58177 | High | 8.1 | 2026-07-29 | The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from… |
CVE-2026-58154 | High | 8.9 | 2026-07-29 | Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0… |
CVE-2026-35226 | Medium | 6.5 | 2026-07-29 | An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFIN… |
CVE-2026-15057 | High | 7.5 | 2026-07-28 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation. |
CVE-2026-48394 | High | 7.8 | 2026-07-28 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-48393 | High | 7.8 | 2026-07-28 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-48392 | High | 7.8 | 2026-07-28 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-48372 | High | 7.8 | 2026-07-28 | Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Expl… |
CVE-2026-62434 | Medium | 5.3 | 2026-07-28 | A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory manage… |
CVE-2026-21047 | | 2026-07-28 | Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code. | |
CVE-2026-64772 | Critical | 9.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, mac… |
CVE-2026-64770 | Critical | 9.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-64769 | Critical | 9.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-64764 | High | 7.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-64763 | High | 7.8 | 2026-07-27 | An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, ma… |
CVE-2026-64754 | Medium | 5.5 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 1… |
CVE-2026-64739 | High | 8.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-64725 | High | 7.1 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-43816 | Medium | 5.5 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionO… |
CVE-2026-43810 | Critical | 9.8 | 2026-07-27 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m… |
CVE-2026-43803 | Critical | 9.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-43802 | Critical | 9.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS So… |
CVE-2026-43774 | Medium | 5.5 | 2026-07-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app m… |
CVE-2026-43767 | Medium | 5.0 | 2026-07-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able t… |
CVE-2026-43748 | Critical | 9.8 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26… |
CVE-2026-43744 | Medium | 5.5 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macO… |
CVE-2026-43739 | Medium | 5.5 | 2026-07-27 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionO… |
CVE-2026-10682 | Medium | 6.6 | 2026-07-27 | The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t sr… |
CVE-2026-59250 | | 2026-07-27 | Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially… | |
CVE-2026-55737 | High | 7.5 | 2026-07-27 | Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term f… |
CVE-2026-17572 | Medium | 5.5 | 2026-07-27 | Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (cr… |
CVE-2026-64449 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buf… |
CVE-2026-64446 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie i… |
CVE-2026-64440 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_handler() HT_caps_handler() iterates pIE->le… |
CVE-2026-64432 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns In the analysis pass… |
CVE-2026-64431 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling post_write_mst_fixup() for invalid index_block ntfs_icx_ib_sync_write… |
CVE-2026-64402 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() When the SMB sink is use… |
CVE-2026-64381 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix next buffer leak in receive_encrypted_standard() receive_encrypted_stand… |
CVE-2026-64367 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow goodix_hid_set… |
CVE-2026-64366 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert wacom_wac_queue_insert… |
CVE-2026-64333 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix write buffer corruption The digi_write_inb_command() is… |
CVE-2026-64323 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vat() takes the virtu… |
CVE-2026-64322 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udf_load_sparable_… |
CVE-2026-64304 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c… |
CVE-2026-64276 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() al… |
CVE-2026-64274 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodix_ts_read_input_report() cop… |
CVE-2026-64270 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114_interrupt() reads a packet… |
CVE-2026-64268 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/… |
CVE-2026-66041 | High | 8.8 | 2026-07-24 | FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt… |
CVE-2026-64217 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in netfs_extract_user_iter() Fix netfs_extract_user_iter() so th… |
CVE-2026-45813 | High | 8.8 | 2026-07-24 | Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add So… |
CVE-2026-16870 | High | 8.8 | 2026-07-24 | Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stac… |
CVE-2026-16807 | High | 8.8 | 2026-07-23 | Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML pag… |
CVE-2026-65706 | High | 7.8 | 2026-07-23 | FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by… |
CVE-2026-65705 | High | 7.8 | 2026-07-23 | FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by… |
CVE-2026-65704 | High | 7.8 | 2026-07-23 | FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processe… |
CVE-2026-65703 | High | 7.8 | 2026-07-23 | FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption… |
CVE-2026-64835 | High | 8.8 | 2026-07-22 | FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attacker… |
CVE-2026-40691 | High | 7.5 | 2026-07-22 | In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply… |
CVE-2026-16419 | Critical | 9.6 | 2026-07-21 | Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker to potentially perform a sandbox escape via… |
CVE-2026-16413 | High | 8.3 | 2026-07-21 | Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-47178 | Medium | 6.1 | 2026-07-21 | libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component… |
CVE-2026-10678 | High | 8.1 | 2026-07-21 | The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte… |
CVE-2026-59147 | Critical | 9.8 | 2026-07-21 | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find. The attach-time vali… |
CVE-2026-59146 | High | 7.8 | 2026-07-21 | Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cel… |
CVE-2026-16367 | Critical | 10.0 | 2026-07-21 | Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-64608 | Critical | 9.8 | 2026-07-21 | Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not… |
CVE-2026-15903 | High | 8.8 | 2026-07-20 | Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-15813 | Medium | 6.5 | 2026-07-20 | A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The internal reassembly code does not properly… |
CVE-2026-64145 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix dma_buffer leak on bus acquire failure wilc_wlan_firmware_download()… |
CVE-2026-64097 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating [Why&How] The GPIO pin… |
CVE-2026-64085 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer adm1266_pm… |
CVE-2026-64084 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR adm1266_gpio_get_… |
CVE-2026-64081 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Validate framework notification message layout Framework notifications… |
CVE-2026-64074 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap statmount_mnt_idmap() w… |
CVE-2026-64063 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix streaming write being overwritten In order to avoid reading whilst writing, ne… |
CVE-2026-64041 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: fs210x: fix possible buffer overflow In fs210x_effect_scene_info(), a strin… |
CVE-2026-63996 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpl… |
CVE-2026-63995 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate start_cmd_payload_size from module The CMIS firmware update code… |
CVE-2026-63794 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In sev_dbg_crypt(), the p… |
CVE-2026-53380 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: media: rzv2h-ivc: Fix concurrent buffer list access The list of buffers (`rzv2h_ivc::buff… |
CVE-2026-16225 | Medium | 6.3 | 2026-07-19 | A security flaw has been discovered in davenardella snap7 up to 1.4.3. The impacted element is the function TSnap7Peer::NegotiatePDULength of the file src/core… |
CVE-2026-16095 | High | 8.8 | 2026-07-18 | A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setup_conntrack of the file /sbin/rc. Executing a m… |
CVE-2026-45784 | High | 7.1 | 2026-07-17 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher… |
CVE-2026-44436 | High | 7.5 | 2026-07-16 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial… |
CVE-2026-15997 | | 2026-07-16 | Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated w… | |
CVE-2026-61389 | High | 7.0 | 2026-07-16 | An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, poten… |
CVE-2026-60063 | High | 7.0 | 2026-07-16 | An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, poten… |
CVE-2026-15422 | | 2026-07-16 | The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since… | |
CVE-2026-10589 | Medium | 6.0 | 2026-07-16 | A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode. |
CVE-2026-10587 | Medium | 6.0 | 2026-07-16 | A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode. |
CVE-2026-3842 | High | 7.8 | 2026-07-16 | A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when… |
CVE-2026-50144 | High | 7.1 | 2026-07-15 | ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier… |
CVE-2026-40953 | Medium | 4.4 | 2026-07-15 | CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access and administrator pe… |
CVE-2026-62349 | High | 8.3 | 2026-07-15 | TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString(… |
CVE-2026-10673 | High | 8.3 | 2026-07-15 | The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mo… |