cve.bz

CWE-125: Out-of-bounds Read, page 31

Filter

The product reads data past the end, or before the beginning, of the intended buffer.

What the weakness is: CWE-125 at MITRE

Ask an AI about CWE-125

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-125: Out-of-bounds Read and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/125.html and https://cve.bz/cve/cwe/125?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.2CVE-2026-50429EPSS 1.1%

    Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.

  2. 5.5CVE-2026-50428EPSS 0.4%

    Out-of-bounds read in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally.

  3. 7.8CVE-2026-50422EPSS 0.3%

    Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

  4. 5.5CVE-2026-50420EPSS 0.4%

    Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to disclose information locally.

  5. 5.5CVE-2026-50408EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  6. 5.5CVE-2026-50401EPSS 0.4%

    Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally.

  7. 7.8CVE-2026-50399EPSS 0.3%

    Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

  8. 7.8CVE-2026-50388EPSS 0.5%

    Out-of-bounds read in Windows NTFS allows an unauthorized attacker to execute code locally.

  9. 7.8CVE-2026-50377EPSS 0.4%

    Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

  10. 5.5CVE-2026-49177EPSS 0.4%

    Out-of-bounds read in Windows TCP/IP allows an authorized attacker to disclose information locally.

  11. 5.5CVE-2026-47969EPSS 0.3%

    Audition is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user intera…

  12. 5.5CVE-2026-58614EPSS 0.4%

    Out-of-bounds read in Windows Kernel allows an authorized attacker to bypass a security feature locally.

  13. 7.8CVE-2026-58609EPSS 0.5%

    Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

  14. 7.5CVE-2026-57979EPSS 0.9%

    Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.

  15. 3.3CVE-2026-56193EPSS 0.5%

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  16. 7.0CVE-2026-54996EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

  17. 7.0CVE-2026-54991EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

  18. 6.1CVE-2026-54988EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  19. 7.0CVE-2026-54111EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

  20. 8.3CVE-2026-54058EPSS 0.5%

    Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row wi…

  21. 5.5CVE-2026-50300EPSS 0.4%

    Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to disclose information locally.

  22. 4.6CVE-2026-49794EPSS 0.5%

    Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.

  23. 9.1CVE-2026-60082EPSS 0.7%

    DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. …

  24. 7.5CVE-2026-59198EPSS 0.3%

    Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generate…

  25. 7.5CVE-2025-53379EPSS 0.5%

    A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request.

  26. 9.1CVE-2026-10672EPSS 0.6%

    subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying …

  27. 6.8CVE-2026-53566EPSS 0.2%

    Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows. This issue affects Citrix Secure Access Client for Windows: before 26.6.1.20.

  28. 4.8CVE-2026-12478EPSS 0.2%

    The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame …

  29. 9.1CVE-2026-58102EPSS 0.3%

    Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extension hash (via extensions(), extensions_by_long_name(), extensions_by_oid(), or ha…

  30. 9.1CVE-2026-51541EPSS 0.6%

    OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An attacker can send a valid ENIP SendRRData frame carrying a very short CIP payload w…

  31. 9.1CVE-2026-51537EPSS 0.6%

    EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malformed packets. An attacker can send a valid ENIP outer frame carrying a malformed …

  32. 6.8CVE-2026-60103EPSS 0.2%

    Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short member_index value in the SDNA …

  33. 8.4CVE-2026-57432EPSS 0.2%

    Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times…

  34. 5.1CVE-2026-57158EPSS 0.7%

    FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.…

  35. 6.5CVE-2026-57157EPSS 0.5%

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled scan attacker-supplied DeviceName and VirtualChannelName fields f…

  36. 5.1CVE-2026-14461EPSS 0.4%

    mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a …

  37. 7.5CVE-2026-40454EPSS 0.5%

    Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client process on malformed server data. This issue affects Apache IoTDB C++ clien…

  38. 8.7CVE-2026-11404EPSS 0.6%

    Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating i…

  39. 1.9CVE-2026-15185EPSS 0.2%

    A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Executing a manipulation of the argument num_langs can lead to out-of-bounds read. T…

  40. 6.1CVE-2026-58307EPSS 0.2%

    Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c.

  41. 6.1CVE-2026-58304EPSS 0.2%

    Out-of-bounds read, Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before 779f6bedf58f334dec64b0a51ebb724b4708b84a.

  42. 8.8CVE-2026-15114EPSS 0.3%

    Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: High)

  43. 6.9CVE-2026-29007EPSS 0.7%

    U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet w…

  44. 4.8CVE-2026-56374EPSS 0.2%

    ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out of bounds read by crafting malicious FTXT image file…

  45. 2.1CVE-2026-56362EPSS 0.2%

    ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation…

  46. 6.1CVE-2026-57258EPSS 0.2%

    The PRC file header parsing logic trusts the constructed file structure description information, assumes that the underlying array contains elements and reads them, leading to out-of-bounds reads and application crashes.

  47. 6.1CVE-2026-57257EPSS 0.2%

    During the PRC parsing stage, there is a lack of boundary verification for the PRC entity index, which leads to an out-of-bounds read of the entity array. As a result, the application crashes.

  48. 6.1CVE-2026-57255EPSS 0.2%

    The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The function's output is not validated; when subsequently read, it produces an illegal pointer that acce…

  49. 6.1CVE-2026-57253EPSS 0.2%

    An abnormal image object causes the renderer to enter the wrong processing branch. When converting the scan lines, an invalid image buffer pointer is used, resulting in the application crashing.

  50. 6.1CVE-2026-57243EPSS 0.2%

    During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, with outdated page information, the application attempts to access invalid addresses, causing the app…