CVE-2026-111272 LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image...

CVE-2026-111272 LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image...

CVE-2026-111272

The LibRaw library (versions through 0.22.2 ) is vulnerable to a heap-based out-of-bounds read within the LibRaw::parseNikonMakernote() function. An attacker can trigger this by providing a crafted Nikon NEF/TIFF image containing a 5-byte ShotInfo tag that declares version 243. This flaw allows t...

CVE-2026-111271 libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...

CVE-2026-111271 libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...

CVE-2026-111271

The libmodplug library (versions through 0.8.9.1 ) is vulnerable to a heap-based out-of-bounds read in the CSoundFile::ReadAMS2() function located in src/load_ams.cpp. An attacker can provide a crafted AMS file where the pattern effect bytes maintain bit 7 as set. This action drives the decoder p...

CVE-2024-58397 MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters

MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications li...

CVE-2026-111269

Versions of libical through 4.0.6 are vulnerable to a heap-based out-of-bounds read in the icalvalue_decode_ical_string() function located in src/libical/icalvalue.c. This flaw occurs when the software decodes input ending in a backslash, specifically when handling escaped iCalendar text; the pro...

CVE-2026-111269 libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the...

CVE-2024-58397

Versions of MP4v2 through 2.1.3 are vulnerable to a heap-based out-of-bounds read in the MP4File::GetChapters() function. An attacker can exploit this by providing a crafted MP4 file where a QuickTime chapter sample is shorter than its declared title length. This allows the attacker to read past ...

CVE-2024-58397 MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters

MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications li...

CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read

The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...

CVE-2026-92228

The apache-airflow-providers-keycloak component is vulnerable due to an issue in the multi-team provisioning function (_attach_team_permissions). This flaw incorrectly grants every team role global read access to audit logs. Affected deployments are those that enable multi-team mode with the Keyc...

CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read

The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...

CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read

The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...

CVE-2026-108436

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-108434

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-105037

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...

EUVD-2026-102448

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-108436

An out-of-bounds read vulnerability exists in Microsoft Office Word , which allows an unauthorized attacker to disclose information over a network. The vulnerability is categorized under CWE-125 and has a base severity of MEDIUM (6.5) as reported by Microsoft. While the technical root cause and s...