CWE-125
CVEs classified under CWE-125, newest first.
1988 CVEsRSS
CVE-2026-116736Medium· 6.1libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array
Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted P…
CVE-2026-116733Low· 3.7flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number
flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immedi…
CVE-2026-116744Medium· 5.3ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector
ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP …
CVE-2026-116732Medium· 4.4libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table
libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero …
CVE-2026-116729Low· 3.3libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with n…
CVE-2026-116727Low· 3.3gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c
gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to …
CVE-2026-116728Medium· 5.5libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x0024
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not checked against the source metadata block. Attackers can supply a crafted FileV…
CVE-2026-116725Medium· 5.5gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index
gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .g…
CVE-2026-57184Medium· 6.3Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `info…
CVE-2026-116463Medium· 6.3FastStone Image Viewer Box-Average Downsampler FUN_0062d96c out-of-bounds
A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attac…
CVE-2026-115680Medium· 6.5Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission
Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission
CVE-2026-116544Low· 3.7Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output
Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a craf…
CVE-2026-107157Low· 2.0Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.
CVE-2026-116487Medium· 4.6PoCNXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RN…
CVE-2026-116261Low· 3.5libimobiledevice AFC File afc.c afc_file_open out-of-bounds
A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds rea…
CVE-2026-82943Medium· 6.5Out-of-Bounds Read via Unchecked Length Values
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses…
CVE-2026-82947High· 7.1Multiple Out-of-Bounds Reads in Frame Processing
SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages wi…
CVE-2026-107896High· 7.8V-SFT provided by FUJI ELECTRIC CO., LTD
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-107900High· 7.8V-SFT provided by FUJI ELECTRIC CO., LTD
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-107897High· 7.8V-SFT provided by FUJI ELECTRIC CO., LTD
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-107899High· 7.8V-SFT provided by FUJI ELECTRIC CO., LTD
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on th…
CVE-2026-107898High· 7.8V-SFT provided by FUJI ELECTRIC CO., LTD
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the af…
CVE-2026-116142Low· 3.3ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box
ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read durin…
CVE-2026-115801Medium· 5.3PoCKakao khaiii JSON Config File Linear.cpp open out-of-bounds
A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the…
CVE-2026-53920High· 8.7odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, ca…
CVE-2026-115485Medium· 6.3Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a…
CVE-2026-115484High· 7.6Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same n…
CVE-2026-115486High· 7.1Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated uncond…
CVE-2026-114459Low· 3.7Mod_qos: out-of-bounds reads in response-body substring matching
A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by t…
CVE-2026-96639Critical· 9.8Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Pillow multi-frame loaders can reuse stale native image storage after mode transitions