Export limit exceeded: 12053 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,053

Export CSV
CVE-2026-112052

libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing

libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Spatialite
Products
Libspatialite
CVE-2026-112053

Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix

Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filter index of 7 or more or transform depth of 5 or 6 to crash decoding applications.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Schroedinger
Products
Schroedinger
CVE-2026-112055

wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP

wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like AbiWord.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wvware
Products
Wv
CVE-2026-112056

wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH

wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past heap arrays, crashing applications such as AbiWord.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wvware
Products
Wv
CVE-2026-112057

libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters

libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vts_ttn than the title set's entries to crash applications enumerating chapters.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Videolan
Products
Libdvdnav
CVE-2026-112058

libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT

VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Videolan
Products
Libdvdnav
CVE-2026-112271

libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser

libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Emersion
Products
Libdisplay-info
CVE-2026-112272

libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser

Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file to over-advance the parse cursor and crash applications.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Emersion
Products
Libdisplay-info
CVE-2026-112274

libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init

libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Libtins
Products
Libtins
CVE-2026-112284

libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR

libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Xqq
Products
Libaribcaption
CVE-2026-109395

Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ning
Products
Compress-lzf
CVE-2026-91186

PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write

The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one after IDAT rewrites the image width, height, bit depth and pixel depth *after* the decoded-data buffer has already been allocated and filled from the original values. The pass that reverses the PNG row filters then derives its own extent from the new dimensions and walks the old allocation, moving image bytes past the end of it. The buffer is allocated by GUIX rather than supplied by the caller, so the application has no way to size it defensively. The decoder is compiled in by default.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx Guix
CVE-2026-92446

GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader

`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded. This is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx Guix
CVE-2026-91059

JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size

The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a `GX_PIXELMAP` whose reported dimensions and `data_size` exceed the allocation behind it. Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path. Reproduces in the shipped default configuration; `GX_SOFTWARE_DECODER_SUPPORT` is enabled by default.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx Guix
CVE-2026-92454

JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx Guix
CVE-2026-91057

Out-of-bounds read when a multi-line text view string ends with a carriage return

`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in `_gx_multi_line_text_view_string_total_rows_compute()` and a row of text that is not in the source.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx Guix
CVE-2026-95507

libslirp: libslirp: out-of-bounds read in NC-SI OEM response handler discloses host memory to guest

An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure of adjacent host process memory.

CVSS 3.1 · 4.3 Medium EPSS n/a KEV · Not listed
Vendors
Libslirp Project
Products
Libslirp
CVE-2026-12314

Memory safety bug fixed in Thunderbird 152

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-12310

Memory safety bug fixed in Thunderbird 152

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird