cve.bz

CWE-125: Out-of-bounds Read, page 43

Filter

The product reads data past the end, or before the beginning, of the intended buffer.

What the weakness is: CWE-125 at MITRE

Ask an AI about CWE-125

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-125: Out-of-bounds Read and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/125.html and https://cve.bz/cve/cwe/125?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.1CVE-2026-33822EPSS 0.4%

    Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  2. 7.5CVE-2026-33096EPSS 1.2%

    Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

  3. 7.1CVE-2026-32188EPSS 0.4%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  4. 7.8CVE-2026-32076EPSS 0.3%

    Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

  5. 5.5CVE-2026-27931EPSS 0.5%

    Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.

  6. 5.5CVE-2026-27930EPSS 0.4%

    Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.

  7. 7.8CVE-2026-26156EPSS 0.4%

    Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally.

  8. 7.8CVE-2026-26153EPSS 0.3%

    Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.

  9. 7.8CVE-2026-27284EPSS 0.2%

    InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this…

  10. 5.3CVE-2026-5713EPSS 0.1%

    The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that proce…

  11. 6.9CVE-2026-39979EPSS 0.6%

    jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input bu…

  12. 6.1CVE-2026-39956EPSS 0.2%

    jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies …

  13. 7.1CVE-2026-33905EPSS 0.2%

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the -sample operation has an out of bounds read when an specific offset is set through the `sampl…

  14. 7.5CVE-2026-32605EPSS 0.5%

    nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal …

  15. 7.5CVE-2026-30997EPSS 0.3%

    An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

  16. 9.1CVE-2026-25209EPSS 0.3%

    Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.

  17. 9.1CVE-2026-25206EPSS 0.2%

    Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.

  18. 7.8CVE-2026-31413EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR maybe_fork_scalars() is called for both BPF_AND and BPF_OR when the source operand is a constant. Whe…

  19. 6.3CVE-2026-5393EPSS 0.2%

    Dual-Algorithm CertificateVerify out-of-bounds read. When processing a dual-algorithm CertificateVerify message, an out-of-bounds read can occur on crafted input. This can only occur when --enable-experimental and --enable-dual-alg-certs i…

  20. 2.3CVE-2026-5392EPSS 0.2%

    Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 message can trigger an OOB read on the heap. The missing bounds check is in the indefinite-length end-of-content verification loop in PKCS7_VerifySignedData().

  21. 9.0CVE-2026-34987EPSS 0.3%

    Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-…

  22. 9.0CVE-2026-34971EPSS 0.3%

    Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address…

  23. 6.9CVE-2026-34941EPSS 0.4%

    Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byt…

  24. 5.5CVE-2026-39856EPSS 0.1%

    osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). Wh…

  25. 5.5CVE-2026-39855EPSS 0.1%

    osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). Whe…

  26. 9.1CVE-2026-5445EPSS 0.7%

    An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETTE COLOR` images does not validate pixel indices against the lookup table size. C…

  27. 7.1CVE-2026-5441EPSS 0.1%

    An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes the proprietary Philips Compression format, does not properly validate escape ma…

  28. 7.5CVE-2026-5437EPSS 0.6%

    An out-of-bounds read vulnerability exists in `DicomStreamReader` during DICOM meta-header parsing. When processing malformed metadata structures, the parser may read beyond the bounds of the allocated metadata buffer. Although this issue …

  29. 8.1CVE-2026-5913EPSS 0.2%

    Out of bounds read in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)

  30. 8.1CVE-2026-5907EPSS 0.2%

    Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted video file. (Chromium security severity: Low)

  31. 5.3CVE-2026-5886EPSS 0.2%

    Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

  32. 8.8CVE-2026-5873EPSS 0.4%

    Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

  33. 4.8CVE-2026-40026EPSS 0.1%

    The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_des, and len_src fields from the disk image to memcpy data into a stack buffer w…

  34. 4.8CVE-2026-40025EPSS 0.1%

    The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past t…

  35. 4.9CVE-2026-39864EPSS 0.3%

    Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.0.5 and 5.8.7, an out-of-bounds read in the auth module of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process cr…

  36. 7.5CVE-2026-28386EPSS 0.5%

    Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. Impact summary: This out-of-bounds r…

  37. 8.5CVE-2026-32864EPSS 0.1%

    There is a memory corruption vulnerability due to an out-of-bounds read in mgcore_SH_25_3!aligned_free() in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires …

  38. 8.5CVE-2026-32863EPSS 0.2%

    There is a memory corruption vulnerability due to an out-of-bounds read in sentry_transaction_context_set_operation() in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitat…

  39. 9.8CVE-2026-5735EPSS 0.3%

    Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulne…

  40. 6.1CVE-2026-35444EPSS 0.3%

    SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the color…

  41. 7.5CVE-2026-35203EPSS 0.3%

    ZLMediaKit is a streaming media service framework. the VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload based on flag bits in the first byte, without verifying that sufficient data exists in the buf…

  42. 5.9CVE-2026-35201EPSS 0.3%

    Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are tr…

  43. 7.1CVE-2026-35176EPSS 0.2%

    openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in POFParser::parseSection() that allows out-of-bounds heap memory access when parsing a crafted .pof file. No FPGA h…

  44. 7.1CVE-2026-35170EPSS 0.2%

    openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in BitParser::parseHeader() that allows out-of-bounds heap memory access when parsing a crafted .bit file. No FPGA ha…

  45. 8.6CVE-2026-34588EPSS 0.5%

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before 3.2.7, 3.3.9, and 3.4.9, internal_exr_undo_piz() advances the working wav…

  46. 7.1CVE-2026-5673EPSS 0.2%

    A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a u…

  47. 7.1CVE-2026-31407EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel wit…

  48. 9.8CVE-2026-31405EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are d…

  49. 5.3CVE-2026-34776EPSS 0.2%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerabl…

  50. 7.5CVE-2026-34824EPSS 0.8%

    Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework.…