Weakness (CWE)
CWE-126: Buffer Over-read
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Source: MITRE CWE-126
585 results · Feed
-
Medium 6.9
X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server.
-
Medium 6.5
Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the `PJSIP…
-
Medium 6.5
odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endi…
-
High 8.7
odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header …
-
High 8.1
info leak uploading over WebSockets with GnuTLS
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was gi…
-
High 8.8
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretati…
-
Medium 6.3
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply …
-
Medium 4.3
MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser a…
-
Medium 5.5
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtd…
-
Medium 6.5
Microsoft Office PowerPoint Information Disclosure Vulnerability
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
-
High 7.0
Multiple vulnerabilities in bhyve device models
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the…
-
Medium 6.5
Role: DNS Server Information Disclosure Vulnerability
Buffer over-read in DNS Server allows an authorized attacker to disclose information over a network.
-
Medium 5.5
Windows Broadcast DVR User Service Information Disclosure Vulnerability
Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft Office Excel Information Disclosure Vulnerability
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
-
High 7.8
Windows GDI Elevation of Privilege Vulnerability
Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Windows StateRepository API Information Disclosure Vulnerability
Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Common Log File System Driver Information Disclosure Vulnerability
Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally.
-
Medium 4.6
Windows rndismp6.sys Information Disclosure Vulnerability
Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack.
-
Medium 6.5
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Buffer over-read in Windows IKE Extension allows an authorized attacker to deny service over a network.
-
Medium 5.5
Windows Encrypting File System (EFS) Information Disclosure Vulnerability
Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Event Logging Service Information Disclosure Vulnerability
Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Management Instrumentation Information Disclosure Vulnerability
Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Win32 Kernel Subsystem Information Disclosure Vulnerability
Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft Office Excel Information Disclosure Vulnerability
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft Office Word Information Disclosure Vulnerability
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows USB Driver Information Disclosure Vulnerability
Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows CD-ROM Driver Elevation of Privilege Vulnerability
Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.
-
Medium 5.5
Windows CD-ROM Driver Information Disclosure Vulnerability
Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally.
-
Medium 5.5
Servicing Stack Updates Information Disclosure Vulnerability
Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.
-
High 7.8
Windows Overlay Filter Elevation of Privilege Vulnerability
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Servicing Stack Updates Information Disclosure Vulnerability
Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.
-
Medium 5.5
Desktop Window Manager Information Disclosure Vulnerability
Buffer over-read in Desktop Window Manager allows an authorized attacker to disclose information locally.
-
High 7.8
Windows Overlay Filter Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Overlay Filter Elevation of Privilege Vulnerability
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Overlay Filter Elevation of Privilege Vulnerability
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Windows Overlay Filter Information Disclosure Vulnerability
Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally.
-
High 7.8
Windows Overlay Filter Remote Code Execution Vulnerability
Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.
-
Low 3.6
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when par…
-
Low 3.6
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 charact…
-
Low 2.9
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions again…