cve.bz

CWE-125: Out-of-bounds Read, page 23

Filter

The product reads data past the end, or before the beginning, of the intended buffer.

What the weakness is: CWE-125 at MITRE

Ask an AI about CWE-125

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-125: Out-of-bounds Read and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/125.html and https://cve.bz/cve/cwe/125?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 3.3CVE-2026-63632EPSS 0.2%

    Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_converter.convert_version() can perform an out-of-bounds read in Gemm_7_6::adapt_gemm_7_6() in onnx/versio…

  2. 6.8CVE-2026-23935EPSS 0.5%

    A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.

  3. 2.1CVE-2026-75090EPSS 0.7%

    A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convert_gguf_to_hf_tokenizer of the file mistralrs-core/src/gguf/gguf_tokenizer.rs of the component GGUF Tokenizer. The manipulati…

  4. 6.6CVE-2026-65349EPSS 0.2%

    An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected syste…

  5. 4.3CVE-2026-64784EPSS 0.6%

    An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted …

  6. 8.2CVE-2026-65832EPSS 0.6%

    Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the …

  7. 8.2CVE-2026-63409EPSS 0.5%

    Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp, causing the missing…

  8. 8.7CVE-2026-74238EPSS 0.5%

    TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent …

  9. 8.7CVE-2026-71980EPSS 0.6%

    Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundarie…

  10. 4.3CVE-2026-12630EPSS 0.3%

    Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table, which has 13 entries, using…

  11. 7.3CVE-2026-40144EPSS 0.1%

    A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior to version 26.1.2. Insufficient validation of input processed by the component may result in memor…

  12. 2.0CVE-2026-19955EPSS 0.4%

    A vulnerability was detected in TrailDB 0.6. Impacted is the function tdb_open of the file /src/tdb.c of the component TOC Validation. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploi…

  13. 8.8CVE-2026-72107EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but era_map() calculates the writeset block before appl…

  14. 9.8CVE-2026-72084EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer core_scsi3_decode_spec_i_port() and core_scsi3_emulate_register_and_move() hand the raw PERSISTENT …

  15. 8.8CVE-2026-72029EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder mux_dl_adb_decode() walks a chain of aggregated datagram tables using offsets and lengths taken from th…

  16. 7.3CVE-2026-72019EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsec_encrypt() macsec_encrypt() reads the Ethernet header via eth_hdr(skb) (skb->head + skb->mac_header) to memmove() the 12 …

  17. 8.1CVE-2026-68472EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211_gen_new_ie() copies ML probe response elements from the parent frame when the parent EHT multi-link element …

  18. 5.1CVE-2026-49282EPSS 0.2%

    Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexin…

  19. 5.3CVE-2026-18020EPSS 0.5%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking.

  20. 5.3CVE-2026-17649EPSS 0.4%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

  21. 5.4CVE-2026-17226EPSS 0.4%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read.

  22. 5.3CVE-2026-17212EPSS 0.5%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

  23. 6.5CVE-2026-16878EPSS 0.4%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

  24. 5.3CVE-2026-16861EPSS 0.5%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

  25. 5.3CVE-2026-16859EPSS 0.4%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

  26. 7.5CVE-2026-16853EPSS 0.4%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

  27. 8.7CVE-2026-55402EPSS 0.4%

    CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service.

  28. 7.2CVE-2026-73515EPSS 0.6%

    PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a …

  29. 7.1CVE-2026-68453EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Add validation of both the actual key buffer size and token length fields in all the cca_check_sec*token() functi…

  30. 5.7CVE-2026-14256EPSS 0.1%

    ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash.

  31. 6.6CVE-2026-73583EPSS 0.1%

    A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication (IPC) message parsing. By sending a specially crafted mess…

  32. 8.2CVE-2026-17485EPSS 0.5%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive information due to an integer underflow.

  33. 7.5CVE-2026-19654EPSS 0.8%

    A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confident…

  34. 6.1CVE-2026-73434EPSS 0.1%

    A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vp…

  35. 6.0CVE-2026-19643EPSS 0.6%

    An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input. To remediate this i…

  36. 7.7CVE-2026-16863EPSS 0.5%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

  37. 6.1CVE-2026-12232EPSS 0.1%

    The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no range validation. The value indexes the fixed-size static const uint8_t alh_handshak…

  38. 7.1CVE-2026-68447EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without boundi…

  39. 8.6CVE-2026-68433EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. That is the …

  40. 7.1CVE-2026-18694EPSS 0.4%

    An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries agains…

  41. 7.1CVE-2026-18688EPSS 0.4%

    An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a …

  42. 6.5CVE-2026-70328EPSS 0.9%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

  43. 6.5CVE-2026-70327EPSS 0.9%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

  44. 5.5CVE-2026-70315EPSS 0.4%

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  45. 5.5CVE-2026-70310EPSS 0.4%

    Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  46. 7.8CVE-2026-68814EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  47. 5.5CVE-2026-68813EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  48. 5.5CVE-2026-68808EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  49. 5.5CVE-2026-68802EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  50. 5.5CVE-2026-68797EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.