CWE-787 · Out-of-bounds Write (page 8)
Page 8 of 100 — CVEs classified under CWE-787, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48337 | High | 7.8 | 2026-07-14 | Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-48336 | High | 7.8 | 2026-07-14 | Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-48335 | High | 7.8 | 2026-07-14 | Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-48370 | High | 7.8 | 2026-07-14 | Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio… |
CVE-2026-48369 | High | 7.8 | 2026-07-14 | Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-48367 | High | 7.8 | 2026-07-14 | After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio… |
CVE-2026-48366 | High | 7.8 | 2026-07-14 | Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio… |
CVE-2026-48343 | High | 7.8 | 2026-07-14 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-48341 | High | 7.8 | 2026-07-14 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-48311 | High | 7.8 | 2026-07-14 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-48274 | High | 7.8 | 2026-07-14 | After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio… |
CVE-2026-48270 | High | 7.8 | 2026-07-14 | Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-47976 | High | 7.8 | 2026-07-14 | Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio… |
CVE-2026-55130 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-55056 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-48368 | High | 7.8 | 2026-07-14 | Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of… |
CVE-2026-48365 | High | 7.8 | 2026-07-14 | Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of… |
CVE-2026-48309 | High | 7.8 | 2026-07-14 | Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of… |
CVE-2026-47968 | High | 7.8 | 2026-07-14 | Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of… |
CVE-2026-47967 | High | 7.8 | 2026-07-14 | Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of… |
CVE-2026-59197 | High | 8.2 | 2026-07-14 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd… |
CVE-2026-59205 | High | 7.5 | 2026-07-14 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption whe… |
CVE-2026-59199 | High | 7.5 | 2026-07-14 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates n… |
CVE-2026-10669 | High | 7.8 | 2026-07-14 | On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture hook that verifies a user… |
CVE-2026-8314 | High | 7.3 | 2026-07-14 | A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The vulnerability stems from impr… |
CVE-2026-8313 | High | 7.3 | 2026-07-14 | A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from imp… |
CVE-2026-8312 | High | 7.3 | 2026-07-14 | A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from impr… |
CVE-2026-8085 | High | 7.3 | 2026-07-14 | A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from impr… |
CVE-2026-44747 | Critical | 9.9 | 2026-07-14 | SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could… |
CVE-2026-15545 | High | 8.8 | 2026-07-13 | A vulnerability was identified in Shibby Tomato up to 1.28.0000. Affected by this vulnerability is the function main of the file www/apcupsd/tomatodata.cgi of… |
CVE-2026-10665 | High | 7.4 | 2026-07-12 | In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed… |
CVE-2026-10664 | Medium | 5.0 | 2026-07-12 | The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Ti… |
CVE-2026-10660 | Medium | 6.4 | 2026-07-11 | The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a si… |
CVE-2026-55233 | High | 7.5 | 2026-07-10 | OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 i… |
CVE-2026-41154 | High | 7.8 | 2026-07-10 | Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB i… |
CVE-2026-55827 | High | 7.5 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass de… |
CVE-2026-55687 | High | 7.5 | 2026-07-10 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write… |
CVE-2026-59857 | Medium | 5.5 | 2026-07-09 | Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a… |
CVE-2026-57021 | Medium | 5.3 | 2026-07-09 | An Out-of-bounds Write vulnerability in the http-gatekeeper (http-gk) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attac… |
CVE-2026-33799 | Medium | 4.3 | 2026-07-09 | An Out-of-bounds Write vulnerability in the SNMP daemon (snmpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacke… |
CVE-2026-60094 | Medium | 6.5 | 2026-07-09 | Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash… |
CVE-2026-59691 | High | 7.1 | 2026-07-09 | A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp frame… |
CVE-2026-58304 | Medium | 6.1 | 2026-07-09 | Out-of-bounds read, Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before 779f6bedf58… |
CVE-2026-15114 | High | 8.8 | 2026-07-08 | Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-15105 | Medium | 6.3 | 2026-07-08 | A flaw has been found in davenardella snap7 up to 1.4.3. This affects the function TS7Worker::PerformFunctionRead of the file src/core/s7_server.cpp of the com… |
CVE-2026-0288 | High | 7.5 | 2026-07-08 | Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated at… |
CVE-2026-59948 | High | 7.0 | 2026-07-08 | Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packag… |
CVE-2026-57260 | High | 7.8 | 2026-07-08 | The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object… |
CVE-2026-14739 | Critical | 9.8 | 2026-07-07 | DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did… |
CVE-2026-42953 | | 2026-07-07 | The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past the end of an alloca… | |
CVE-2026-21384 | Medium | 5.3 | 2026-07-06 | Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits. |
CVE-2026-21370 | Medium | 5.3 | 2026-07-06 | Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values. |
CVE-2026-21369 | Medium | 5.3 | 2026-07-06 | Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification. |
CVE-2026-21368 | Medium | 5.3 | 2026-07-06 | Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks. |
CVE-2026-40257 | Medium | 5.5 | 2026-07-06 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technolog… |
CVE-2026-53362 | High | 7.8 | 2026-07-04 | In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the p… |
CVE-2026-14612 | Medium | 4.2 | 2026-07-03 | Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized r… |
CVE-2026-8247 | High | 8.8 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary cod… |
CVE-2026-13384 | High | 7.2 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a spe… |
CVE-2026-13383 | High | 7.2 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a sp… |
CVE-2026-13053 | High | 7.2 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially cra… |
CVE-2026-13050 | High | 7.2 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a sp… |
CVE-2026-14422 | High | 8.8 | 2026-07-01 | Out of bounds read and write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2026-14420 | Critical | 9.6 | 2026-07-01 | Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HT… |
CVE-2026-14400 | High | 8.3 | 2026-07-01 | Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-14397 | Critical | 9.6 | 2026-07-01 | Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-14395 | High | 8.8 | 2026-07-01 | Out of bounds write in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-14392 | Critical | 9.6 | 2026-07-01 | Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2026-14385 | High | 8.8 | 2026-07-01 | Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to perform out of bounds memory access via a crafted HTM… |
CVE-2026-58592 | High | 8.3 | 2026-07-01 | Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is… |
CVE-2026-55597 | Medium | 5.5 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments ca… |
CVE-2026-55577 | Medium | 5.9 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow… |
CVE-2025-23351 | Critical | 9.0 | 2026-07-01 | NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bo… |
CVE-2025-23350 | Critical | 9.0 | 2026-07-01 | NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bo… |
CVE-2026-7840 | Critical | 9.8 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in… |
CVE-2026-7838 | High | 8.8 | 2026-07-01 | UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/… |
CVE-2026-7831 | High | 7.6 | 2026-07-01 | UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the… |
CVE-2026-7829 | High | 7.2 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, afte… |
CVE-2026-20461 | Medium | 5.3 | 2026-07-01 | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue… |
CVE-2026-20458 | High | 7.5 | 2026-07-01 | In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a ro… |
CVE-2026-14191 | High | 7.8 | 2026-07-01 | An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector… |
CVE-2026-54900 | | 2026-07-01 | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj… | |
CVE-2026-54592 | High | 7.5 | 2026-07-01 | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child, when invoked recursively ov… |
CVE-2026-54696 | Low | 3.7 | 2026-06-30 | Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an o… |
CVE-2026-14152 | Critical | 9.6 | 2026-06-30 | Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-14087 | High | 8.8 | 2026-06-30 | Heap buffer overflow in WebNN in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentia… |
CVE-2026-14063 | Medium | 5.7 | 2026-06-30 | Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memo… |
CVE-2026-13873 | Medium | 6.5 | 2026-06-30 | Out of bounds read in Layout in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-14241 | Critical | 9.8 | 2026-06-30 | Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these cou… |
CVE-2026-43745 | Medium | 6.5 | 2026-06-29 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-43712 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visio… |
CVE-2026-43703 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Ta… |
CVE-2026-43676 | Medium | 6.5 | 2026-06-29 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-28979 | Medium | 6.5 | 2026-06-29 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and… |
CVE-2026-13592 | High | 7.3 | 2026-06-29 | A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWriter::append of… |
CVE-2026-9105 | Medium | 6.5 | 2026-06-29 | An authenticated stack-based buffer overflow vulnerability exists in the web management interface of TP-Link TL-WR841N v14. A remote authenticated attacker ca… |
CVE-2026-10644 | Medium | 4.2 | 2026-06-28 | The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mchp_sercom_g1.c), used by the PIC32CM-JH SoC family, contains an out-of-bounds write in its asynchron… |
CVE-2026-58049 | High | 8.6 | 2026-06-28 | FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and v… |
CVE-2026-10643 | High | 8.7 | 2026-06-28 | Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffe… |
CVE-2026-45258 | High | 7.8 | 2026-06-27 | dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could over… |