CWE-125
CVEs classified under CWE-125, newest first.
2121 CVEsRSS
CVE-2026-16530Medium· 6.5Pcp: pcp: remote denial of service and information leakage
A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which c…
CVE-2026-17701Critical· 9.6Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page
Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chrom…
CVE-2026-55777NoneGoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, the parse_ios() function uses an attacker-controlled keyword-to-OS offset as both the source o…
CVE-2026-66360High· 7.5The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation
The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zer…
CVE-2026-66349Medium· 6.5The MMS server connection handler contains a flaw in its processing of BER-encoded request data
The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its int…
CVE-2026-63033Medium· 6.5A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated message buffer.
A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated message buffer.
CVE-2026-61893Medium· 6.5A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer.
A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer.
CVE-2026-56758Medium· 6.5The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment
The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to rea…
CVE-2026-17678High· 8.8Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page
Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-58216Medium· 5.3An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structur…
CVE-2026-67550Medium· 5.7re2 provides Node.js bindings for Google's RE2 regular expression engine
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and spl…
CVE-2026-58160Medium· 6.5Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to ve…
Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to ve…
CVE-2026-17550Medium· 5.5A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability
A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.
CVE-2026-16465Medium· 6.1A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability
A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.
CVE-2026-17072Low· 3.3Gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing flac codec data in matroska containers
A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary che…
CVE-2026-66759High· 7.1PoCGimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafte…
CVE-2026-15003Medium· 5.6Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service
A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file…
CVE-2026-64551High· 7.0⚖ disputedkernel: sctp: validate STALE_COOKIE cause length before reading staleness (CVE-2026-64551)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP). This vulnerability allows a remote attacker or a local unprivileged user to potentially access and disclose sensitive information. By sending a malformed e…
CVE-2026-64546Medium· 5.5kernel: drm/edid: fix OOB read in drm_parse_tiled_block() (CVE-2026-64546)
A flaw was found in the Linux kernel. A specially crafted Extended Display Identification Data (EDID), which describes display capabilities, can cause a heap out-of-bounds read in the `drm_parse_tiled_block()` function within the `drm/edid…
CVE-2026-64540Medium· 5.5⚖ disputedkernel: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (CVE-2026-64540)
A flaw was found in the Linux kernel's GeneLink (GL620A) USB network driver. A malicious GeneLink device can send specially crafted Universal Serial Bus (USB) packets that cause an out-of-bounds read vulnerability. This can lead to the dis…
CVE-2026-64536Low· 8.1kernel: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (CVE-2026-64536)
A flaw was found in the Linux kernel rtl8723bs staging Wi-Fi driver. is_ap_in_tkip() reads an information-element header and its vendor or RSN payload without checking that those bytes remain in the buffer, so a truncated element causes an…
CVE-2026-43738Medium· 5.5The issue was addressed with improved memory handling
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. Processing a maliciously crafted asset c…
CVE-2026-64524Medium· 5.5⚖ disputedkernel: drm/hyperv: validate resolution_count and fix WIN8 fallback (CVE-2026-64524)
A flaw was found in the Linux kernel's `drm/hyperv` component. A malicious Hyper-V guest could exploit an out-of-bounds memory access vulnerability by sending a crafted resolution response. This could potentially lead to information disclo…
CVE-2026-64441Low· 8.8kernel: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (CVE-2026-64441)
A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. This vulnerability involves out-of-bounds reads in several functions responsible for parsing information elements (IE) and attributes. Due to missing checks on the size of in…
CVE-2026-64448High· 7.0kernel: smb: client: restrict implied bcc[0] exemption to responses without data area (CVE-2026-64448)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. An attacker, by operating a malicious SMB server, could send specially crafted responses during the session negotiation phase. This could cause the client to read be…
CVE-2026-64444High· 8.1staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each iteration but only guards on i < pkt_le…
CVE-2026-64442Low· 8.1kernel: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (CVE-2026-64442)
A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. Insufficient boundary checks in the information element (IE) parsing loops within the `issue_assocreq()` and `join_cmd_hdl()` functions allow a remote attacker to cause an ou…
CVE-2026-64443Low· 8.1kernel: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (CVE-2026-64443)
A flaw was found in the Linux kernel. A remote attacker could exploit an out-of-bounds read vulnerability in the `update_beacon_info()` function by sending a specially crafted wireless Beacon frame containing a malformed Information Elemen…
CVE-2026-64422High· 7.1In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP socket state
In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP socket state. The sysctl is sto…
CVE-2026-64411High· 7.1In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find_table_lock() update_counters() and compat_update_counters() forward a user-supplied 32-byte table name to find_ta…
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find_table_lock() update_counters() and compat_update_counters() forward a user-supplied 32-byte table name to find_ta…