CWE-126: Buffer Over-read
Filter
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
What the weakness is: CWE-126 at MITRE
Ask an AI about CWE-126
Show the prompt
Explain CWE-126: Buffer Over-read and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/126.html and https://cve.bz/cve/cwe/126?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.3CVE-2026-124317
libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multib…
- 6.9CVE-2026-93524EPSS 0.2%
A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server.
- 6.5CVE-2026-57185EPSS 0.5%
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer ove…
- 6.5CVE-2026-55606EPSS 0.5%
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size param…
- 8.7CVE-2026-53920EPSS 0.4%
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, cast…
- 8.1CVE-2026-107928EPSS 0.7%
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the numbe…
- 8.8CVE-2026-112404EPSS 0.4%
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated Pho…
- 6.3CVE-2026-112394EPSS 0.6%
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. …
- 4.3CVE-2026-85745EPSS 0.5%
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the mu…
- 5.5CVE-2026-46471EPSS 0.2%
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory …
- 6.5CVE-2026-108454EPSS 0.7%
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- 7.0CVE-2026-101310EPSS 0.1%
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject …
- 6.5CVE-2026-97828EPSS 0.9%
Buffer over-read in DNS Server allows an authorized attacker to disclose information over a network.
- 5.5CVE-2026-96851EPSS 0.4%
Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-96848EPSS 0.4%
Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-95904EPSS 0.3%
Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.
- 6.5CVE-2026-88201EPSS 0.6%
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
- 6.5CVE-2026-88195EPSS 0.8%
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
- 6.5CVE-2026-88167EPSS 0.9%
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
- 5.5CVE-2026-85935EPSS 0.4%
Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-85910EPSS 0.4%
Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-85835EPSS 0.4%
Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.
- 9.8CVE-2026-83888EPSS 1.0%
Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.
- 5.5CVE-2026-83835EPSS 0.9%
Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally.
- 4.6CVE-2026-83788EPSS 0.5%
Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack.
- 7.8CVE-2026-83727EPSS 0.4%
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
- 5.5CVE-2026-83719EPSS 0.4%
Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.
- 6.5CVE-2026-83685EPSS 1.3%
Buffer over-read in Windows IKE Extension allows an authorized attacker to deny service over a network.
- 5.5CVE-2026-83565EPSS 0.5%
Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-70234EPSS 0.4%
Buffer over-read in Desktop Window Manager allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-70041EPSS 0.5%
Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally.
- 7.8CVE-2026-69957EPSS 0.4%
Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
- 5.5CVE-2026-69954EPSS 0.5%
Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally.
- 7.8CVE-2026-69953EPSS 0.4%
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2026-69950EPSS 0.4%
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2026-69942EPSS 0.4%
Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.
- 7.8CVE-2026-69884EPSS 0.4%
Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.
- 5.5CVE-2026-103567EPSS 0.4%
Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.
- 2.9CVE-2026-96394EPSS 0.10%
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to a…
- 3.6CVE-2026-101130EPSS 0.10%
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Aff…
- 3.6CVE-2026-101094EPSS 0.10%
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craf…
- 7.5CVE-2026-57546EPSS 0.2%
Transient DOS when processing a continuous receive command with a zero-sized global configuration override.
- 5.3CVE-2026-20541EPSS 0.2%
In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privile…
- 5.3CVE-2026-20540EPSS 0.2%
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges …
- 5.3CVE-2026-20539EPSS 0.2%
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges …
- 5.3CVE-2026-20538EPSS 0.2%
In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privile…
- 7.5CVE-2026-102758EPSS 0.2%
The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates suppl…
- 6.3CVE-2026-102728EPSS 0.2%
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure TLS client's ServerHello parser and DTLS client's HelloVerifyRequest parser read fields before checking that the message is long enough to contain them. A mali…
- 5.5CVE-2026-96420EPSS 0.09%
Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- 5.5CVE-2026-95392EPSS 0.2%
MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service