CWE-126: Buffer Over-read, page 4
Filter
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
What the weakness is: CWE-126 at MITRE
Ask an AI about CWE-126
Show the prompt
Explain CWE-126: Buffer Over-read and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/126.html and https://cve.bz/cve/cwe/126?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2026-26184EPSS 0.2%
Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.
- 6.1CVE-2026-26169EPSS 2.3%
Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally.
- 6.5CVE-2026-26155EPSS 0.9%
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
- 2.1CVE-2026-5772EPSS 0.2%
A 1-byte stack buffer over-read was identified in the MatchDomainName function (src/internal.c) during wildcard hostname validation when the LEFT_MOST_WILDCARD_ONLY flag is active. If a wildcard * exhausts the entire hostname string, the …
- 7.5CVE-2026-21381EPSS 0.2%
Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.
- 7.8CVE-2026-21378EPSS 0.08%
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
- 7.8CVE-2026-21376EPSS 0.1%
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
- 7.8CVE-2026-21375EPSS 0.08%
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
- 7.8CVE-2026-21374EPSS 0.1%
Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.
- 7.8CVE-2026-21373EPSS 0.08%
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
- 7.8CVE-2026-21371EPSS 0.1%
Memory Corruption when retrieving output buffer with insufficient size validation.
- 7.5CVE-2026-21367EPSS 0.2%
Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.
- 7.1CVE-2025-47400EPSS 0.10%
Cryptographic issue while copying data to a destination buffer without validating its size.
- 7.8CVE-2025-47390EPSS 0.1%
Memory corruption while preprocessing IOCTL request in JPEG driver.
- 6.3CVE-2026-2394EPSS 0.2%
Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before…
- 8.2CVE-2026-24028EPSS 1.1%
An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of s…
- 6.8CVE-2025-66038EPSS 0.3%
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibb…
- 7.4CVE-2026-4371EPSS 0.4%
A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfu…
- 7.8CVE-2025-59600EPSS 0.08%
Memory Corruption when adding user-supplied data without checking available buffer space.
- 7.8CVE-2026-28364EPSS 0.2%
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the r…
- 4.4CVE-2026-27799EPSS 0.1%
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occur…
- 7.1CVE-2026-27798EPSS 0.2%
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability occurs when processing an image with small dimension using the `…
- 5.5CVE-2026-26271EPSS 0.3%
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread in `freerdp_image_copy_from_icon_data()` (libfreerdp/codec/color.c) can be triggered by crafted RDP Window Icon (TS_ICON_INFO) data…
- 7.5CVE-2026-3203EPSS 0.2%
RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service
- 5.2CVE-2026-26282EPSS 0.2%
NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap read in `.NET Single File` bundle header parser due to missing bounds check. Opening a crafted file wi…
- 8.3CVE-2026-25646EPSS 1.1%
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function.…
- 7.5CVE-2026-20846EPSS 1.4%
Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.
- 6.5CVE-2025-47402EPSS 0.2%
Transient DOS when processing a received frame with an excessively large authentication information element.
- 7.5CVE-2025-66692EPSS 0.4%
A buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 8.7CVE-2025-60003EPSS 0.4%
A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When an affected device receives…
- 6.5CVE-2025-47395EPSS 0.1%
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.
- 6.1CVE-2025-47331EPSS 0.08%
Information disclosure while processing a firmware event.
- 5.5CVE-2025-47330EPSS 0.07%
Transient DOS while parsing video packets received from the video firmware.
- 1.9CVE-2025-11961EPSS 0.1%
pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement ha…
- 7.8CVE-2025-62560EPSS 0.5%
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 6.5CVE-2025-62473EPSS 1.1%
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- 7.8CVE-2025-62467EPSS 0.4%
Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-62464EPSS 0.4%
Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-62462EPSS 0.4%
Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-62461EPSS 0.4%
Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.
- 9.1CVE-2025-12106EPSS 0.6%
Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses
- 7.3CVE-2025-63602EPSS 0.3%
A vulnerability was discovered in Awesome Miner thru 11.2.4 that allows arbitrary read and write to kernel memory and MSRs (such as LSTAR) as an unprivileged user. This is due to the implementation of an insecure version of WinRing0 (1.2.0…
- 7.8CVE-2025-60720EPSS 0.4%
Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.
- 1.9CVE-2025-12745EPSS 0.2%
A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file quickjs.c. This manipulation causes buffer over-read. The attack is restricted to local e…
- 7.8CVE-2025-47368EPSS 0.09%
Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing.
- 6.1CVE-2025-47362EPSS 0.08%
Information disclosure while processing message from client with invalid payload.
- 6.1CVE-2025-27064EPSS 0.08%
Information disclosure while registering commands from clients with diag through diagHal.
- 6.9CVE-2025-62792EPSS 0.4%
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match() when strlen() is called on str_test, because the corresponding buffer is not b…
- 2.1CVE-2025-62787EPSS 0.4%
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.10.2, a buffer over-read occurs in DecodeWinevt() when child_attr[p]->attributes[j] is accessed, because the corresponding index (j) i…
- 5.3CVE-2025-60729EPSS 0.3%
PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function