Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,053

Export CSV
CVE-2026-111124

CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nasa
Products
Cfitsio
CVE-2026-111269

libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Libical Libical Project
Products
Libical Libical
CVE-2026-111149

FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits

FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Freeimage Project
Products
Freeimage
CVE-2026-111139

NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmp_decode().

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Netsurf-browser
Products
Libnsbmp
CVE-2026-87849

Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing

The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client. Root Cause: In src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process. Affected Scenarios: An operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list. How to Fix: 1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3533 The fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Brpc
CVE-2026-111159

libewf through 20260924 Heap Out-of-Bounds Read via L01 Extended Attribute Parsing

libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application or leak uninitialized heap memory through extended attributes.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Libyal
Products
Libewf
CVE-2026-16833

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to disclose kernel memory due to an out-of-bounds read.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aix Powervm Vios Vios
CVE-2026-70652

libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map through VipsForeignSaveUhdr. The undersized allocation can cause a heap buffer over-read that may disclose adjacent data or crash the process. This issue is fixed in version 8.18.3.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Libvips
Products
Libvips
CVE-2026-88842

Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Hardened Images Hummingbird
CVE-2026-98893

firmware: arm_scmi: Validate SENSOR_UPDATE payload size

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate SENSOR_UPDATE payload size SENSOR_UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not verify that the received payload contains those entries before parsing them. Reject truncated update notifications before reading the variable array.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Linux Kernel
CVE-2026-98891

wifi: mac80211: validate deauth frame length before reason access

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length first and only then read the reason code.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Linux Kernel
CVE-2026-98887

wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally reads IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLA_BINARY .len is a maximum) and the op sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is accepted and the loop reads past the payload. Require the exact length in the policy, so a malformed attribute is rejected before the handler runs.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Linux Kernel
CVE-2026-85808

Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability

Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more