Export limit exceeded: 11727 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11727 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-77214 | 2 Libexpat, Libexpat Project | 2 Expat, Libexpat | 2026-10-27 | 8.2 High |
| libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives. | ||||
| CVE-2026-75147 | 1 Ffmpeg | 1 Ffmpeg | 2026-10-27 | 7.1 High |
| FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data. A crafted OBU size causes the remaining-size counter to wrap to a positive value, causing the next loop iteration to dereference a pointer beyond the end of the packet buffer. A crafted AV1 input packet muxed to RTP triggers the out-of-bounds read. | ||||
| CVE-2026-75146 | 1 Ffmpeg | 1 Ffmpeg | 2026-10-27 | 8.1 High |
| FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh. | ||||
| CVE-2026-116736 | 2 Libpff Project, Libyal | 2 Libpff, Libpff | 2026-10-27 | 6.1 Medium |
| Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash. | ||||
| CVE-2026-98890 | 1 Linux | 2 Linux, Linux Kernel | 2026-10-27 | 4.4 Medium |
| In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The generic length check only rejects zero-length and oversized skbs, so a short monitor frame can be read past the end of the skb data. Require enough bytes for the radiotap TX header and the destination address field before using the monitor-mode header layout. | ||||
| CVE-2026-107157 | 1 Qt | 2 Qt, Qtbase | 2026-10-27 | N/A |
| Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information. | ||||
| CVE-2026-116732 | 1 Libdwarf Project | 1 Libdwarf | 2026-10-27 | 4.4 Medium |
| libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers. | ||||
| CVE-2026-98892 | 1 Linux | 2 Linux, Linux Kernel | 2026-10-27 | 4.4 Medium |
| In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size BASE_ERROR_EVENT carries a variable number of message reports, with the count encoded in error_status. The notification parser used that count without checking whether the received payload contained all reported entries. Reject truncated payloads before copying the report array. | ||||
| CVE-2026-112629 | 1 Apple | 3 Ios And Ipados, Macos, Visionos | 2026-10-27 | 6.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may lead to unexpected app termination. | ||||
| CVE-2026-107472 | 1 Qt | 3 Qt, Qt5compat, Qtbase | 2026-10-27 | N/A |
| An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data. | ||||
| CVE-2026-105946 | 1 Qt | 2 Qt, Qtbase | 2026-10-27 | N/A |
| Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM. | ||||
| CVE-2024-58399 | 2 Ggml, Ggml-org | 2 Llama.cpp, Llama.cpp | 2026-10-27 | 6.1 Medium |
| llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the process or load adjacent process memory as model weights. | ||||
| CVE-2025-71439 | 2 Ggml, Ggml-org | 2 Llama.cpp, Llama.cpp | 2026-10-27 | 5.5 Medium |
| llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past id_to_token and crash. | ||||
| CVE-2026-112604 | 1 Apple | 1 Macos | 2026-10-27 | N/A |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to unexpected app termination. | ||||
| CVE-2026-112425 | 1 Apple | 4 Ios And Ipados, Macos, Tvos and 1 more | 2026-10-27 | N/A |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a 3D model may result in disclosure of process memory. | ||||
| CVE-2026-111147 | 2 Libesedb Project, Libyal | 2 Libesedb, Libesedb | 2026-10-27 | 6.1 Medium |
| Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or expose up to about 32 KiB of adjacent heap memory. | ||||
| CVE-2026-113940 | 1 Apple | 1 Macos | 2026-10-27 | N/A |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-113936 | 1 Apple | 1 Macos | 2026-10-27 | N/A |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-86973 | 1 Apple | 3 Ios And Ipados, Macos, Safari | 2026-10-27 | N/A |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. Processing maliciously crafted web content may lead to an unexpected process crash. | ||||
| CVE-2026-111135 | 2 Libfwsi Project, Libyal | 2 Libfwsi, Libfwsi | 2026-10-27 | 6.1 Medium |
| libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag to crash consuming processes. | ||||