CVE-2026-111677: Out-of-bounds Read

Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap...

PT-2026-115586

Name of the Vulnerable Software and Affected Versions spice-server affected versions not specified Description Multiple migration data handlers fail to perform bounds validation on client-supplied offsets within SPICE MSGC MIGRATE DATA messages. This allows an authenticated SPICE client to perfor...

UBUNTU-CVE-2026-111143

Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilovexbin in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer...

CVE-2026-46472

An out-of-bounds read vulnerability exists in GStreamer gst-plugins-good before version 1.28.2 . The flaw is located in the isomp4 plugin's qtdemux_parse_chnl function, which may read past the boundary of a global array while parsing a crafted MP4 media file. A remote attacker could exploit this ...

UBUNTU-CVE-2026-111125

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

PT-2026-115622

Name of the Vulnerable Software and Affected Versions Thermo Fisher Torrent Suite Software affected versions not specified Description An authenticated attacker can exploit a path traversal flaw to read arbitrary files on the Torrent Server that are accessible to the web service account. This iss...

UBUNTU-CVE-2026-111135

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpvolumevaluesreaddata that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump li...

UBUNTU-CVE-2026-111272

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image...

UBUNTU-CVE-2026-110876

AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before notetable by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read duri...

CVE-2026-111140

libregf through 20260526 contains a heap out-of-bounds read in libregfvalueitemreadvaluedata because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacen...

CVE-2026-111165

libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTMLoad because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and...

UBUNTU-CVE-2026-111133

libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...

UBUNTU-CVE-2026-111159

libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewflefextendedattributereaddata because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application or lea...

UBUNTU-CVE-2026-111131

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...

UBUNTU-CVE-2026-111162

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser WMParseNewHmp that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing application...

Linux Distros Unpatched Vulnerability : CVE-2026-111375

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap...

Linux Distros Unpatched Vulnerability : CVE-2026-111126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of processitem in src/xlsparse.c that allows attackers to read past...

Linux Distros Unpatched Vulnerability : CVE-2026-111272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer...

RHEL 10 : kernel (RHSA-2026:83707)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:83707 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth: MGMT: validate LT...

Linux Distros Unpatched Vulnerability : CVE-2026-111134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpfileentryvaluesreaddata that allows attackers to read past buffer bounds...