Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 365

Export CSV
CVE-2026-34085

fontconfig: Fontconfig: Security flaw allows arbitrary code execution or system crash

fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fontconfig Project
Products
Fontconfig
CVE-2023-6779

Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()

An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer size to store the message, resulting in an application crash. This issue affects glibc 2.37 and newer.

CVSS 3.1 · 8.2 High EPSS 3.2% KEV · Not listed
Vendors
Fedoraproject Gnu Redhat
Products
Fedora Glibc Enterprise Linux
CVE-2026-44603

Out-of-Bounds Read in Tor via Malformed BEGIN Cell

Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Torproject
Products
Tor
CVE-2026-43860

mutt: mutt: Authentication bypass due to IMAP CRAM-MD5 hash truncation

mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Mutt
Products
Mutt
CVE-2026-6527

Uncontrolled Recursion in Wireshark

ASN.1 PER protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2026-41502

BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an off-by-one out-of-bounds read vulnerability in bacnet-stack's ReadPropertyMultiple service decoder allows unauthenticated remote attackers to read one byte past an allocated buffer boundary by sending a crafted RPM request with a truncated object identifier. The vulnerability is in rpm_decode_object_id(), which checks apdu_len < 5 but then accesses all 6 byte positions (indices 0-5) — consuming 1 byte for the context tag, 4 bytes for the object ID, then reading apdu[5] for the opening tag check. A 5-byte input passes the length check but causes a 1-byte OOB read, leading to crashes on embedded BACnet devices. The vulnerability exists in src/bacnet/rpm.c and affects any deployment that enables the ReadPropertyMultiple confirmed service handler (enabled by default in the reference server). This vulnerability is fixed in 1.4.3.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-40254

FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/drive/client/drive_file.c`. The `contains_dotdot()` function catches `../` and `..\` mid-path but misses `..` when it's the last component with no trailing separator. A rogue RDP server can read, list, or write files one directory above the client's shared folder through RDPDR requests. This requires the victim to connect with drive redirection enabled. Version 3.25.0 patches the issue.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-32605

Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses > instead of >= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Nimiq
Products
Core-rs-albatross Nimiq Proof-of-stake
CVE-2008-0122

libbind off-by-one buffer overflow

Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.

CVSS 2.0 · 10.0 Critical EPSS 12.4% KEV · Not listed
Vendors
Freebsd Isc Redhat
Products
Freebsd Bind Enterprise Linux
CVE-2007-3961

fsplib off-by-one error

Off-by-one error in the fsp_readdir_r function in fsplib.c in fsplib before 0.9 allows remote attackers to cause a denial of service via a directory entry whose length is exactly MAXNAMELEN, which prevents a terminating null byte from being added.

CVSS 2.0 · 5.0 Medium EPSS 2.1% KEV · Not listed
Vendors
Fsp
Products
C Library
CVE-2007-4137

QT off by one buffer overflow

Off-by-one error in the QUtf8Decoder::toUnicode function in Trolltech Qt 3 allows context-dependent attackers to cause a denial of service (crash) via a crafted Unicode string that triggers a heap-based buffer overflow. NOTE: Qt 4 has the same error in the QUtf8Codec::convertToUnicode function, but it is not exploitable.

CVSS 2.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Conectiva Gentoo Mandrakesoft and 3 more
Products
Linux Linux Mandrake Linux and 5 more
CVE-2009-3551

Wireshark: Off-by-one error in the Samba dissector

Off-by-one error in the dissect_negprot_response function in packet-smb.c in the SMB dissector in Wireshark 1.2.0 through 1.2.2 allows remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 5.0 Medium EPSS 1.5% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2009-1884

perl-Compress-Raw-Bzip2: Off-by-one error in the bzinflate function - DoS (crash)

Off-by-one error in the bzinflate function in Bzip2.xs in the Compress-Raw-Bzip2 module before 2.018 for Perl allows context-dependent attackers to cause a denial of service (application hang or crash) via a crafted bzip2 compressed stream that triggers a buffer overflow, a related issue to CVE-2009-1391.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Bzip Perl
Products
Compress-raw-bzip2 Perl
CVE-2008-7224

elinks: entity_cache static array buffer overflow (off-by-one)

Buffer overflow in entity_cache in ELinks before 0.11.4rc0 allows remote attackers to cause a denial of service (crash) via a crafted link.

CVSS 2.0 · 7.8 High EPSS 2.8% KEV · Not listed
Vendors
Elinks Redhat
Products
Elinks Enterprise Linux
CVE-2008-3535

kernel: fix off-by-one error in iov_iter_advance()

Off-by-one error in the iov_iter_advance function in mm/filemap.c in the Linux kernel before 2.6.27-rc2 allows local users to cause a denial of service (system crash) via a certain sequence of file I/O operations with readv and writev, as demonstrated by testcases/kernel/fs/ftest/ftest03 from the Linux Test Project.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 1 more
CVE-2008-2719

nasm: off-by-one error in the ppscan function

Off-by-one error in the ppscan function (preproc.c) in Netwide Assembler (NASM) 2.02 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted file that triggers a stack-based buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 10.5% KEV · Not listed
Vendors
Nasm
Products
Netwide Assembler
CVE-2007-6336

clamav: off-by-one in the MS-ZIP decompression code

Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP compressed CAB file.

CVSS 2.0 · 6.8 Medium EPSS 4.2% KEV · Not listed
Vendors
Clam Anti-virus
Products
Clamav
CVE-2007-5135

openssl: SSL_get_shared_ciphers() off-by-one

Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow. NOTE: this issue was introduced as a result of a fix for CVE-2006-3738. As of 20071012, it is unknown whether code execution is possible.

CVSS 2.0 · 6.8 Medium EPSS 16.1% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux
CVE-2007-4091

rsync off by one flaw

Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the f_name function.

CVSS 2.0 · 6.8 Medium EPSS 3.3% KEV · Not listed
Vendors
Rsync
Products
Rsync
CVE-2007-2052

python off-by-one locale.strxfrm() (possible memory disclosure)

Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.

CVSS 2.0 · 5.0 Medium EPSS 14.1% KEV · Not listed
Vendors
Python Redhat
Products
Python Enterprise Linux Network Satellite