Export limit exceeded: 17088 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425948 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 29,322

Export CSV
CVE-2026-111272

LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Libraw
Products
Libraw
CVE-2026-111167

GNU LibreDWG through 0.14.8612 Out-of-Bounds Read in acds_private AcDs Decoder

GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property type value to crash dwgread, dwg2dxf, or any application using LibreDWG.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu
Products
Libredwg
CVE-2026-111162

WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmp

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap bytes through WildMidi_GetInfo().

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mindwerks
Products
Wildmidi
CVE-2026-111152

Game Music Emu (libgme) through 0.6.5 Heap Out-of-Bounds Read via AY Loader

Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via gme_track_info or gme_start_track, crashing libgme consumers.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Game-music-emu Project
Products
Game-music-emu
CVE-2026-111142

Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst

Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gdraheim
Products
Zziplib
CVE-2026-111132

GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element

GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome
Products
Libgxps
CVE-2026-111127

catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string

catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fossies
Products
Catdoc
CVE-2026-109448

psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters

Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Psqlodbc
CVE-2026-105228

ISPSoft Out-of-Bounds Read Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Deltaww
Products
Ispsoft
CVE-2026-105227

ISPSoft Out-of-Bounds Read Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Deltaww
Products
Ispsoft
CVE-2026-72107

dm era: fix out-of-bounds memory access for non-zero start sector

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but era_map() calculates the writeset block before applying the target offset. Tables with a non-zero start sector can therefore pass an absolute mapped-device block to metadata_current_marked(). If the absolute block is beyond the current writeset size, writeset_marked() tests past the end of the in-core bitset. KASAN reports this as a vmalloc-out-of-bounds access. Apply the target offset before calculating the era block so writeset lookups use the target-relative block number.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel