PT-2026-115151

Name of the Vulnerable Software and Affected Versions ytnef versions 2.1.2 and earlier Description A heap out-of-bounds read occurs in the DecompressRTF function within lib/ytnef.c because the uncompressedSize for uncompressed RTF streams is not validated. An attacker can use a specially crafted...

PT-2026-115153

Name of the Vulnerable Software and Affected Versions Libyal libesedb versions prior to 20260704 Description A heap out-of-bounds read occurs in the libesedb record get multi value function. This issue allows attackers to read past buffers using unbounded multi-value offset tables. By providing a...

PT-2026-115173

GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds private that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' propert...

PT-2026-115144

Name of the Vulnerable Software and Affected Versions NetSurf libnsbmp versions prior to 0.1.8 Description An out-of-bounds read exists in the bmp decode rle8 and bmp decode rle4 functions. This occurs because absolute-run bound checks omit the word-alignment pad byte. A remote attacker can provi...

PT-2026-115145

Name of the Vulnerable Software and Affected Versions libnsbmp versions prior to 0.1.8 Description An out-of-bounds read exists in the bmp decode mask function. An attacker can trigger a heap over-read, which may crash applications calling bmp decode, by providing a specially crafted ICO file whe...

PT-2026-115159

Name of the Vulnerable Software and Affected Versions Game Music Emu libgme versions prior to 0.6.6 Description A global out-of-bounds read occurs in the mute voices function of Classic Emu. This happens when the software processes NSF files with a voice count exceeding the 16-entry voice-type...

PT-2026-115195

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services dyndns edit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

CVE-2026-108454: Buffer Over-read

Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network...

CVE-2026-108434: Out-of-bounds Read

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-111155: Out-of-bounds Read

libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through midsetsoundfont to read heap memory out of...

CVE-2026-111152: Out-of-bounds Read

Game Music Emu libgme through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader getdata function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via...

CVE-2026-111145: Out-of-bounds Read

ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PTBINARY MAPI property to crash ytnefprint or libytn...

CVE-2026-111138: Out-of-bounds Read

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecoderle8 and bmpdecoderle4 because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-rea...

CVE-2026-111133: Out-of-bounds Read

libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...

CVE-2026-111131: Out-of-bounds Read

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...

CVE-2026-111127: Out-of-bounds Read

catdoc through 0.95 contains an out-of-bounds read vulnerability in copyunicodestring in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST record...

CVE-2026-111125: Out-of-bounds Read

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-110876: Out-of-bounds Read

AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before notetable by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read duri...

CVE-2026-41544: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and...

CVE-2026-24718: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central...