CWE-126: Buffer Over-read, page 3
Filter
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
What the weakness is: CWE-126 at MITRE
Ask an AI about CWE-126
Show the prompt
Explain CWE-126: Buffer Over-read and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/126.html and https://cve.bz/cve/cwe/126?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.4CVE-2026-25288EPSS 0.2%
Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.
- 8.8CVE-2026-66312EPSS 1.1%
Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
- 6.9CVE-2026-55970EPSS 0.8%
Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- 5.3CVE-2026-55238EPSS 0.5%
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validatio…
- 7.1CVE-2026-63091EPSS 0.5%
ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of U…
- 3.1CVE-2026-47088EPSS 0.3%
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When…
- 5.4CVE-2026-62353EPSS 0.4%
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte…
- 5.3CVE-2026-49854EPSS 0.4%
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the …
- 7.8CVE-2026-57968EPSS 0.3%
Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2026-55036EPSS 0.5%
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 7.5CVE-2026-50504EPSS 0.9%
Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
- 5.7CVE-2026-50485EPSS 0.7%
Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.
- 5.5CVE-2026-50475EPSS 0.4%
Buffer over-read in Windows Kernel allows an authorized attacker to disclose information locally.
- 6.5CVE-2026-50468EPSS 1.0%
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
- 7.5CVE-2026-50445EPSS 0.9%
Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a network.
- 7.8CVE-2026-50435EPSS 0.3%
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2026-50402EPSS 0.3%
Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally.
- 5.5CVE-2026-50383EPSS 0.4%
Buffer over-read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
- 7.0CVE-2026-50372EPSS 0.3%
Buffer over-read in Windows Redirected Drive Buffering allows an authorized attacker to elevate privileges locally.
- 5.5CVE-2026-50341EPSS 0.4%
Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally.
- 4.3CVE-2026-59840EPSS 0.3%
A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4.0 through 7…
- 4.3CVE-2025-43892EPSS 0.4%
A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an authenticated remote attacker to return a port…
- 6.1CVE-2026-50813EPSS 0.2%
An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path
- 7.8CVE-2026-21379EPSS 0.1%
Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.
- 8.2CVE-2026-58013EPSS 0.7%
A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This v…
- 8.2CVE-2026-58012EPSS 0.5%
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using …
- 8.2CVE-2026-58010EPSS 0.5%
A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bound…
- 6.9CVE-2026-41992EPSS 0.6%
GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array th…
- 4.8CVE-2026-40210EPSS 0.7%
An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.
- 4.7CVE-2026-45460EPSS 0.4%
Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally.
- 7.8CVE-2026-42828EPSS 0.3%
Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.
- 6.3CVE-2026-11787EPSS 0.2%
A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer over-read in string filter parsing that may influence internal filter processing…
- 7.3CVE-2026-44185EPSS 0.7%
Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, w…
- 5.3CVE-2026-45684EPSS 0.2%
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using …
- 5.5CVE-2025-59609EPSS 0.09%
Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
- 7.1CVE-2026-46149EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer,…
- 8.2CVE-2026-45843EPSS 0.4%
In the Linux kernel, the following vulnerability has been resolved: slip: bound decode() reads against the compressed packet length slhc_uncompress() parses a VJ-compressed TCP header by advancing a pointer through the packet via decode(…
- 8.2CVE-2026-5260EPSS 0.8%
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption…
- 4.3CVE-2026-6575EPSS 0.2%
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that arra…
- 5.3CVE-2026-8463EPSS 0.3%
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input. The auto-detect form of argon2_verify passes encoded_len - 1 as the length argument to memchr without check…
- 5.5CVE-2025-47406EPSS 0.07%
Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.
- 7.5CVE-2025-47403EPSS 0.2%
Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
- 7.5CVE-2025-47401EPSS 0.2%
Transient DOS when processing target power rate tables during channel configuration.
- 7.5CVE-2026-34059EPSS 0.4%
Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
- 7.1CVE-2026-37532EPSS 0.2%
AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, …
- 5.5CVE-2026-6532EPSS 0.2%
Kismet protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
- 6.5CVE-2026-6238EPSS 0.4%
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG rec…
- 8.3CVE-2026-41898EPSS 0.3%
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_state…
- 2.3CVE-2026-0930EPSS 0.2%
Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read after establishing a connection which would leak the adjacent stack memory to t…
- 3.5CVE-2026-40341EPSS 0.2%
libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_unpack_EOS_FocusInfoEx could be used to crash libgphoto2 when processing input from untrusted USB devices. Commit c385b3…