CWE-125
CVEs classified under CWE-125, newest first.
1988 CVEsRSS
CVE-2026-96644High· 8.1PoCPillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
CVE-2026-18748Low· 3.5Out-of-bounds read in Bluetooth Classic A2DP codec information element handling
The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte codec_ie[] array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dp_process_config_in…
CVE-2026-114124Low· 3.9Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering…
CVE-2026-114122Low· 3.9Electron: Frame subscription trusts GPU-supplied frame geometry
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for webContents.beginFrameSub…
CVE-2026-102485Medium· 5.2Out-of-bounds Read in ntpsec
Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mod…
CVE-2026-102486High· 7.5Out-of-bounds Read in ntpsec
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.
CVE-2026-56386High· 7.5Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-len…
CVE-2026-61916NoneApache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by…
CVE-2026-79704NoneApache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly…
CVE-2026-87849Medium· 4.3Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose d…
CVE-2026-111075High· 8.7JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unau…
CVE-2026-110938High· 8.7JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can…
CVE-2026-92824Medium· 6.2Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v…
CVE-2026-114038Medium· 5.1Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose…
CVE-2026-114041Medium· 6.5FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message
FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service …
CVE-2026-114044Medium· 5.3FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline
FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can sen…
CVE-2026-114043Medium· 6.5PoCVulnerability in FreeRDP
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buff…
CVE-2026-112392High· 7.5PoCPillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
CVE-2026-112202NoneImager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low…
CVE-2026-87255Low· 3.7Vulnerability in Oracle Java SE (component: Compiler)
Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protoc…
CVE-2026-93442High· 8.2IBM QRadar SIEM Out-of-bounds Read
IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.
CVE-2026-113310Medium· 6.5⚖ disputedOut of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113309Medium· 6.5Out of bounds read in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Out of bounds read in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113295High· 8.8⚖ disputedchromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-113295)
An out of bounds read flaw was found in the ANGLE component of the Chromium browser. Upstream bug(s): https://issues.chromium.org/issues/568897206
CVE-2026-113095High· 8.8Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113006High· 8.8Out of bounds read in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page
Out of bounds read in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113102Medium· 6.5⚖ disputedOut of bounds read in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113035Medium· 6.5⚖ disputedOut of bounds read in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page
Out of bounds read in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113070Medium· 6.5⚖ disputedOut of bounds read in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Out of bounds read in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113045Medium· 6.5⚖ disputedOut of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page
Out of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)