CVE-2023-43788

Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()

A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat X.org

Products

Fedora Enterprise Linux Rhel Els and 1 more

CVE-2023-42755

Kernel: rsvp: out-of-bounds read in rsvp_classify()

A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 1 more

CVE-2026-121626

GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Willamowius

Products

Gnugk

CVE-2026-121604

wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wlroots

Products

Wlroots

CVE-2026-121599

TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow

A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A950rg A950rg Firmware

CVE-2026-121517

IrfanView TIFF Wang Annotation heap-based overflow

A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: "[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low".

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Irfanview

Products

Irfanview

CVE-2026-120752

PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120740

Hivex: hivex: denial of service via out-of-bounds read in big-data block processing

A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash, resulting in a Denial of Service (DoS).

CVSS 3.1 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Rhel Els

CVE-2026-109161

Buffer Overflow in Digital I/O

Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Welotec

Products

Tk100 Tk500 V2 Tk500 V3

CVE-2026-95726

Unauthenticated Buffer Overflow Vulnerability Leading to Denial-of-Service in HPE Networking VIA

A buffer overflow vulnerability in HPE Networking VIA could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected client.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126820

cpio: cpio: out-of-bounds read in from_ascii() when parsing newc/crc archive headers

No description is available for this CVE.

CVSS 3.1 · 4.4 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-6505

Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Advanced Virtualization Enterprise Linux and 1 more

CVE-2026-77709

SonicOS TACACS+ Client Buffer Overflow Allows Unauthenticated Denial of Service

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sonicwall

Products

Sonicos

CVE-2026-77708

Stack‑Based Buffer Overflow in SonicOS TACACS+ Client Causing Unauthenticated Denial of Service

A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sonicwall

Products

Sonicos

CVE-2026-82308

Unauthenticated Remote Heap Overflow in SonicOS SSL‑VPN Service

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Sonicwall

Products

Sonicos

CVE-2026-40660

Heap-based Out-of-Bounds Read in AMD Compressonator SDK

A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local access to read out-of-bounds heap memory, potentially resulting in information disclosure or application crash.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Amd

Products

Amd Compressionator Sdk

CVE-2026-40652

Out-of-Bounds Read in AMD Compressonator SDK Allowing Local Memory Disclosure or Denial of Service

An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted Truevision Advanced Raster Graphics Adapter (TGA) file to a user or an automated pipeline, potentially resulting in disclosure of sensitive heap memory contents or denial of service.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Amd

Products

Amd Compressionator Sdk

CVE-2026-65108

Heap Buffer Overflow in NVIDIA Slurm slurmstepd with Root Privileges

NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Slurm

CVE-2026-120755

Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter

HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.

CVSS 4.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hdfgroup The Hdf Group

Products

Hdf5 Szip Filter

CVE-2026-65138

slurm: slurm: Information disclosure via arbitrary memory read in slurmstepd socket API

NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Slurm