Export limit exceeded: 24818 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 12051 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,051

Export CSV
CVE-2023-43788

Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()

A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat X.org
Products
Fedora Enterprise Linux Rhel Els and 1 more
CVE-2023-42755

Kernel: rsvp: out-of-bounds read in rsvp_classify()

A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 1 more
CVE-2026-121626

GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Willamowius
Products
Gnugk
CVE-2026-121604

wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wlroots
Products
Wlroots
CVE-2026-120740

Hivex: hivex: denial of service via out-of-bounds read in big-data block processing

A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash, resulting in a Denial of Service (DoS).

CVSS 3.1 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Rhel Els
CVE-2026-126820

cpio: cpio: out-of-bounds read in from_ascii() when parsing newc/crc archive headers

No description is available for this CVE.

CVSS 3.1 · 4.4 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2024-6505

Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Advanced Virtualization Enterprise Linux and 1 more
CVE-2026-40660

Heap-based Out-of-Bounds Read in AMD Compressonator SDK

A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local access to read out-of-bounds heap memory, potentially resulting in information disclosure or application crash.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Amd
Products
Amd Compressionator Sdk
CVE-2026-40652

Out-of-Bounds Read in AMD Compressonator SDK Allowing Local Memory Disclosure or Denial of Service

An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted Truevision Advanced Raster Graphics Adapter (TGA) file to a user or an automated pipeline, potentially resulting in disclosure of sensitive heap memory contents or denial of service.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Amd
Products
Amd Compressionator Sdk
CVE-2026-120755

Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter

HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.

CVSS 4.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hdfgroup The Hdf Group
Products
Hdf5 Szip Filter
CVE-2026-65138

slurm: slurm: Information disclosure via arbitrary memory read in slurmstepd socket API

NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Slurm
CVE-2026-121625

GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Willamowius
Products
Gnugk
CVE-2026-121968

Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets

Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Quozl
Products
Netrek-client-cow
CVE-2026-73471

Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux nikon metadata tag parsing

A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gstreamer
Products
Gst-plugins-good
CVE-2026-111959

Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Arrow Rust
CVE-2026-96546

Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader

A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux Rhel Els
CVE-2026-93009

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dnsmasq Red Hat Redhat
Products
Dnsmasq Enterprise Linux Ceph Storage and 6 more
CVE-2026-90463

Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Rhel Els
CVE-2026-85498

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Polkit Project Redhat
Products
Polkit Enterprise Linux Hummingbird and 2 more
CVE-2026-59842

Libssh: libssh: information disclosure via short gssapi curve25519 public key

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Libssh Redhat
Products
Libssh Enterprise Linux Enterprise Linux For Els and 9 more