Weakness (CWE)
CWE-126: Buffer Over-read
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Source: MITRE CWE-126
267 results · Clear filters · Feed
-
High 7.5
Microsoft SQL Server Information Disclosure Vulnerability
Buffer over-read in SQL Server allows an unauthorized attacker to disclose information over a network.
-
High 7.8
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Buffer over-read in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Message Queuing Denial of Service Vulnerability
Buffer over-read in Windows Message Queuing allows an unauthorized attacker to deny service over a network.
-
High 7.5
Windows iSCSI Target Service Information Disclosure Vulnerability
Buffer over-read in Windows iSCSI Target Service allows an unauthorized attacker to disclose information over a network.
-
High 8.7
odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header …
-
High 8.1
info leak uploading over WebSockets with GnuTLS
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was gi…
-
High 8.8
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretati…
-
High 7.0
Multiple vulnerabilities in bhyve device models
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the…
-
High 7.8
Windows GDI Elevation of Privilege Vulnerability
Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Overlay Filter Elevation of Privilege Vulnerability
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Overlay Filter Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Overlay Filter Elevation of Privilege Vulnerability
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Overlay Filter Elevation of Privilege Vulnerability
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Overlay Filter Remote Code Execution Vulnerability
Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.
-
High 7.5
Buffer Over-read in WLAN HAL
Transient DOS when processing a continuous receive command with a zero-sized global configuration override.
-
High 7.5
The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded dat…
-
High 7.1
Out-of-bounds read in libXtst's RECORD reply parser
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
-
High 7.5
Apache Tomcat Native: DoS via TLS handshake
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versi…
-
High 7.4
Buffer Over-read in WLAN Firmware
Transient DOS while parsing frame during channel usage.
-
High 7.3
Buffer Over-read in OOBM
Information Disclosure when a pointer is reused after being deallocated.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS when processing authentication frames with invalid FILS information element header lengths.
-
High 7.4
Buffer Over-read in BT Controller
Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.
-
High 7.8
Buffer Over-read in Qualcomm IPC
Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.
-
High 7.5
Windows Message Queuing Queue Manager Information Disclosure Vulnerability
Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.
-
High 7.0
Windows Win32k Elevation of Privilege Vulnerability
Buffer over-read in Windows Win32K allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability
Buffer over-read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows NTFS Remote Code Execution Vulnerability
Buffer over-read in Windows NTFS allows an authorized attacker to execute code locally.
-
High 7.5
One byte overflow read in mail parser
A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
-
High 7.5CVE-2026-53587 Public exploit
libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgi…
-
High 7.8
Microsoft Office Word Remote Code Execution Vulnerability
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
High 7.4
Buffer Over-read in WLAN Firmware
Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.
-
High 7.8
Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Windows Overlay Filter Elevation of Privilege Vulnerability
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-50402 Public exploit
NTFS Elevation of Privilege Vulnerability
Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability
Buffer over-read in Windows Redirected Drive Buffering allows an authorized attacker to elevate privileges locally.
-
High 7.8
Buffer Over-read in Windows Compute
Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.
-
High 7.8
Windows Projected File System Elevation of Privilege Vulnerability
Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 7.3
Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
-
High 7.1
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cu…