CVE-2026-48380

Adobe Substance 3D Painter is affected by an out-of-bounds read vulnerability (CWE-125) that could allow an attacker to disclose sensitive memory or information. Exploitation requires user interaction, specifically when a victim opens a malicious file . Adobe has released a priority 3 security up...

CVE-2026-93862

An out-of-bounds read vulnerability exists in the FireCluster Sync processing of Fireware OS . An attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, can send specially crafted network traffic to repeatedly crash the firewall's clust...

CVE-2026-93862 Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service

An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted...

tcpdump

TCPDUMP 4.x.y by The Tcpdump Group To report a security issue please send an e-mail to [email protected]. To report bugs and other problems, contribute patches, request a feature, provide generic feedback etc please see the guidelines for contributing in the tcpdump source tree root. Anonymo...

MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element

Impact The C extension's BSON decoder scans a Regex element's pattern and flags strings with strlen before checking the document's remaining length, so a crafted truncated Regex element can read past the end of the caller's buffer. bson.decode and bson.decodeall accept mmap and array buffers, whi...

GHSA-98QM-WVGF-W4CF MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element

Impact The C extension's BSON decoder scans a Regex element's pattern and flags strings with strlen before checking the document's remaining length, so a crafted truncated Regex element can read past the end of the caller's buffer. bson.decode and bson.decodeall accept mmap and array buffers, whi...

EUVD-2026-110473

snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite...

FreeRDP-Out-of-Bounds-Read-CVE-2024-32459-

FreeRDP-Out-of-Bounds-Read-CVE-2024-32459- The FreeRDP-Out-of-Bounds-Read-CVE-2024-32459 vulnerability is a security flaw discovered in FreeRDP, an open-source program used for implementing the Remote Desktop Protocol RDP This vulnerability arises from input processing weaknesses, allowing an...

CVE-2026-85769

CVE-2026-85769 Heap out-of-bounds read in libtpms TPM 2.0 volatile-state deserialization. An unbounded optional-block skip in blockskipread advances the unmarshal cursor by an attacker-controlled 16-bit length and drives the signed remaining-size counter negative. Every downstream bounds check th...

CVE-2025-38502-Linux-LPE

Abraxas Labs · abraxaslabs.tech · github.com/abraxas · @abraxasnull CVE-2025-38502 Linux kernel BPF cgroup local storage out-of-bounds access via tail calls | ---|--- CVE| CVE-2025-38502 CWE| CWE-125 — Out-of-bounds Read Vendor| Linux kernel Component| kernel/bpf/core.c, include/linux/bpf.h cgrou...

CVE-2026-117557

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

CVE-2026-117555

CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the loadbmp function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dxbytes, causing crashes or heap memory disclosure into the decod...

CVE-2026-117556

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in readpreface in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing read...

CVE-2023-52356-libtiff-analysis

CVE-2023-52356 – libtiff TIFFReadRGBATileExt Analysis Overview This lab analyzes CVE-2023-52356 in libtiff, focusing on the behavior of TIFFReadRGBATileExt when it receives image coordinates outside the valid image bounds. The analysis includes reproduction of the original crash, debugging with...

CVE-2022-46152

CVE-2022-46152 OP-TEE OScleanupshmrefs Out-of-Bounds Read — Reproduction Environment Reference: https://optee.readthedocs.io/en/latest/building/devices/qemu.htmlqemu-v8 Security Advisory: https://github.com/OP-TEE/opteeos/security/advisories/GHSA-65w8-6mrg-52g7 Vulnerability Overview Field| Detai...

vvdecapp Component Buffer Overflow DoS

The vulnerability of the setBufferingPeriodSEI function in the vvdecapp VVdeC component is related to reading data beyond the buffer’s capacity. Exploiting this vulnerability could allow an attacker to cause a service failure or gain access to protected information...

CVE-2026-117557

The SDL_image library, specifically versions through 3.4.8 and 2.8.12 , contains a stack out-of-bounds read vulnerability within the IMG_LoadLBM_IO() function in src/IMG_lbm.c. The root cause is the failure to validate the bitplane count when HAM mode is enabled. An attacker can provide a special...

EUVD-2026-110835

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

CVE-2026-117555

The GreycLab CImg library, version through 4.0.6 , is vulnerable to a heap out-of-bounds read within the _load_bmp() function of CImg.h. The root cause is an integer overflow in the row byte count, which can be triggered by providing a crafted BMP file with a large header width that wraps dx_byte...

CVE-2026-117556

Versions of zchunk prior to 1.5.5 are vulnerable to a heap out-of-bounds read in the read_preface() function located in src/lib/header.c. The vulnerability occurs because the software passes the total header length instead of the remaining bytes to compint parsing functions. An attacker can provi...