CVE-2025-1675

Out of bounds read in dns_copy_qname

The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Zephyrproject Zephyrproject-rtos

Products

Zephyr Zephyr

CVE-2026-16768

Gdk-pixbuf: out-of-bounds read in ico parser

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-16560

389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn

A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Directory Server Enterprise Linux Rhel Els

CVE-2026-1940

Gstreamer: incomplete fix of cve-2026-1940

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Freedesktop Gstreamer and 1 more

Products

Debian Linux Gst-plugins-good Gstreamer and 2 more

CVE-2026-121958

FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys

FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-93522

X.Org Server Glamor CopyArea Heap Buffer Overflow

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

X.org

Products

Xorg-x11-server Xwayland

CVE-2026-93518

X.Org Server XKB ResizeKeyType Numeric Truncation

An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

X.org

Products

Xorg-server Xorg-x11-server Xwayland

CVE-2026-93517

X.Org Server GLX RenderLarge Heap Buffer Overflow

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

X.org X.orgg

Products

X Server Xwayland Xorg-x11-server

CVE-2026-104867

Immich calendar heatmap endpoint discloses cross-user activity through broken access control

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform a separate access check. Any authenticated non-admin user can therefore request another account's upload or capture-date activity heatmap for an arbitrary date range. AssetRepository.getCalendarHeatmap in server/src/repositories/asset.repository.ts filters by owner, date, and deletion state but not visibility, so the returned daily counts and total count include archived and locked assets. The route exposes counts and activity dates but does not return asset metadata or content, and it does not affect integrity or availability. This issue is fixed in version 3.2.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Immich-app

Products

Immich

CVE-2026-103393

Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing

An Out-of-Bounds Read vulnerability in the VRRP implementation in Juniper Networks Session Smart Router allows an L2-adjacent attacker to read stale memory contents or cause a system fault via a specially crafted VRRPv3 advertisement.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Juniper

Products

Session Smart Router

CVE-2026-59007

Out-of-Bounds Read in Android's codebook.c Allows Remote Information Disclosure

In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-112508

Out‑of‑Bounds Read Allowing Unexpected System Termination or Kernel Memory Disclosure in macOS

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2026-121184

chromium-browser: Out of bounds read in Media

Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-118605

Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability

Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the prh_sdp_service_search_decode function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29069.

CVSS 3.0 · 8 High EPSS < 1% KEV · Not listed

Vendors

Alpine

Products

Ilx-f511

CVE-2026-118604

Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability

Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the framework service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29007.

CVSS 3.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Alpine

Products

Ilx-f511

CVE-2026-118603

Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29017.

CVSS 3.0 · 8 High EPSS < 1% KEV · Not listed

Vendors

Alpine

Products

Ilx-f511

CVE-2026-116841

DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup

DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Diasurgical

Products

Devilutionx

CVE-2026-112451

Out-of-Bounds Read Resulting in Denial of Service and Memory Disclosure in macOS

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause a denial-of-service or disclose process memory.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2026-112495

Out-of-Bounds Read in macOS Allows App to Crash or Read Kernel Memory

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2026-12548

Libsoup: heap out-of-bounds read in libsoup due to integer truncation

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Libsoup Redhat

Products

Libsoup Libsoup Enterprise Linux