Export limit exceeded: 16983 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 12053 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,053

Export CSV
CVE-2026-73242

FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-81508

ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Espressif
Products
Esp-idf
CVE-2026-58004

Crafted oversized firmware image causes EL3 stack overflow during VAB authentication on Trusted Firmware.

Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers. This issue affects Trusted Firmware: through socfpga_v2.14.0.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Altera
Products
Trusted Firmware
CVE-2026-93280

greybus: audio: bound the topology section sizes against the fetched size

In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds. Reject a topology whose section sizes do not fit within the fetched size before it is parsed.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-93541

Out-of-bounds read in libXi's XQueryDeviceState()

An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Libxi
CVE-2026-93246

octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvu_register_interrupts() walks every MSI-X vector and uses strstr() to match "Mbox" or "FLR" in irq_name before pinning those interrupts to CPU 0. irq_name is a per-vector NAME_SIZE buffer, but not every slot is populated before this loop runs. strstr() keeps scanning until it finds a NUL terminator, so an uninitialized slot can trigger a KASAN slab-out-of-bounds read at boot when debug options are enabled. Use strnstr() with NAME_SIZE to bound the search within each vector's name buffer.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-93545

Out-of-bounds read in libXi's XListInputDevices()

An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Libxi
CVE-2026-93542

Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes()

An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Libxi
CVE-2026-93543

Out-of-bounds read in libXi's XI2 class parser

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Libxi
CVE-2026-93544

Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing

An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Libxi
CVE-2026-94281

Out-of-bounds read in libXi's XListInputDevices() class parsing

An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Libxi
CVE-2026-77797

Velociraptor Prefetch parser out of bounds

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Rapid7
Products
Velociraptor
CVE-2026-52836

OpenDDS: out-of-bounds `rd_ptr` dereference in `RtpsSampleHeader::init` — triggered by malformed RTPS submessage, remotely exploitable denial of service

OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes dds/DCPS/transport/rtps_udp/RtpsUdpReceiveStrategy.cpp in RtpsUdpReceiveStrategy::handle_input() to advance ACE_Message_Block::rd_ptr() beyond valid data. The parser can then call dds/DCPS/transport/rtps_udp/RtpsSampleHeader.cpp in RtpsSampleHeader::init(), which dereferences the invalid read pointer without first validating it against wr_ptr() or ensuring that a complete submessage header remains. The resulting SIGSEGV occurs in the receive thread, terminates the DDS process, and destroys the DDS entities hosted by that participant. No authentication, prior protocol state, or victim interaction is required. This issue is fixed in version 3.34.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Opendds
Products
Opendds
CVE-2026-84451

libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Struktur
Products
Libheif
CVE-2026-84448

libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Struktur
Products
Libheif
CVE-2026-73863

NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsing

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmq_subinfo_decode() function in nng/src/sp/protocol/mqtt/mqtt_parser.c reuses len_of_varint from the outer Properties Length while parsing each SUBSCRIPTION_IDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte Properties Length and repeated subscription identifiers, causing get_var_integer() to begin at an incorrect offset and read beyond the heap message buffer. The flaw is reachable through the broker receive path and can crash the broker, while the separately reported topic-option off-by-one occurs later and is not this vulnerability. This issue is fixed in version 0.24.14.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Nanomq
Products
Nanomq
CVE-2026-54579

mport mirror-selection ping accepts insufficiently validated ICMP replies

mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. A network attacker able to inject or spoof visible ICMP replies could influence mirror latency selection, while a malformed packet carrying IP options could shift the ICMP header and trigger an out-of-bounds read. This issue is fixed in version 2.7.8.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Midnightbsd
Products
Mport
CVE-2026-79616

Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path.

CVSS 4.0 · 0.6 Low EPSS < 1% KEV · Not listed
Vendors
Qt
Products
Qt
CVE-2026-81334

darknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser

darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknet_network.cpp as xcalloc(net.n, sizeof(Darknet::Layer)), sized to exactly the number of layer sections the file declares. The shortcut, scale_channels and sam sections supply that index through their from field and the route section through its layers field, and parse_shortcut_section in src-lib/darknet_cfg.cpp reads net.layers[index].outputs with no bounds check, which reads past the allocation. The dispatch loop in create_network then reuses the same index to assign net.layers[l.index].use_bin_output and net.layers[l.index].keep_delta_gpu, writing past the allocation at an offset the file controls, with a fixed one-byte value. Parsing a crafted configuration file is sufficient: the parse runs before any weights file is opened and needs no non-default option, so the result is a reliable crash and a write whose location, though not its value, is chosen by whoever supplied the file.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hank-ai
Products
Darknet