21 matches found
CVE-2026-102360
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. readUint8Array never compares the wire-supplied length against the decoder's own view, so on...
CVE-2026-102521
The decoder in readFromDataView in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders' view, thus exposing adjacent process memory. This can be anything that is currently in the head, for example credentials or log...
CVE-2026-102521
The lib0 library, in versions prior to 0.2.119 , contains an out-of-bounds read vulnerability within the readFromDataView decoder. An attacker can trick the decoder into reading beyond its designated buffer view, potentially exposing adjacent process memory , which may include sensitive informati...
@appsoftwareltd/etherpk-mcp (>=0.8.1, <=0.14.0), @bytestream-tv/coop (0.1.0) +61 more potentially affected by CVE-2026-102521 via lib0 (>=0.0.6, <=0.2.117)
lib0 NPM version =0.0.6, =0.8.1, =3.0.0-alpha.1826142686, =3.2.7-alpha.6226622763, =3.0.0-alpha.1826142686, =3.2.7-alpha.6226622763, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.2.7-alpha.6226622763,...
@aicolab/room-service (>=2.0.2, <=2.1.0), @anchrd/intel (>=0.59.0, <=0.125.0) +35 more potentially affected by CVE-2026-102521 via lib0 (>=1.0.0-rc.1, <=1.0.0-rc.32)
lib0 NPM version =1.0.0-rc.1, =2.0.2, =0.59.0, =0.1.0, =0.52.0, =0.0.1-beta.1, =0.52.0, =0.54.0, =0.52.0, =0.54.0, =0.52.0, =0.52.0, =0.52.0, =0.52.0, =0.52.0, =0.52.0, =0.55.0 and more Source cves: CVE-2026-102521 Source advisory: MEND:CVE-2026-102521...
CVE-2026-102521 lib0 `readFromDataView` out-of-bounds read
The decoder in readFromDataView in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders' view, thus exposing adjacent process memory. This can be anything that is currently in the head, for example credentials or log...
CVE-2026-102521 lib0 `readFromDataView` out-of-bounds read
The decoder in readFromDataView in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders' view, thus exposing adjacent process memory. This can be anything that is currently in the head, for example credentials or log...
EUVD-2026-88820
The decoder in readFromDataView in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders' view, thus exposing adjacent process memory. This can be anything that is currently in the head, for example credentials or log...
CVE-2026-102521 lib0 `readFromDataView` out-of-bounds read
The decoder in readFromDataView in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders' view, thus exposing adjacent process memory. This can be anything that is currently in the head, for example credentials or log...
CVE-2026-102360 lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. readUint8Array never compares the wire-supplied length against the decoder's own view, so on...
@aicolab/room-service (>=2.0.2, <=2.1.0), @anchrd/intel (>=0.59.0, <=0.125.0) +35 more potentially affected by CVE-2026-102360 via lib0 (>=1.0.0-rc.1, <=1.0.0-rc.32)
lib0 NPM version =1.0.0-rc.1, =2.0.2, =0.59.0, =0.1.0, =0.52.0, =0.0.1-beta.1, =0.52.0, =0.54.0, =0.52.0, =0.54.0, =0.52.0, =0.52.0, =0.52.0, =0.52.0, =0.52.0, =0.52.0, =0.55.0 and more Source cves: CVE-2026-102360 Source advisory: MEND:CVE-2026-102360...
@appsoftwareltd/etherpk-mcp (>=0.8.1, <=0.14.0), @bytestream-tv/coop (0.1.0) +62 more potentially affected by CVE-2026-102360 via lib0 (>=0.0.4, <=0.2.117)
lib0 NPM version =0.0.4, =0.8.1, =3.0.0-alpha.1826142686, =3.2.7-alpha.6226622763, =3.0.0-alpha.1826142686, =3.2.7-alpha.6226622763, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.2.7-alpha.6226622763,...
CVE-2026-102360 lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. readUint8Array never compares the wire-supplied length against the decoder's own view, so on...
CVE-2026-102360 lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. readUint8Array never compares the wire-supplied length against the decoder's own view, so on...
CVE-2026-102360
The lib0 library, versions 0.2.1-0.2.117 and 1.0.0-rc.32 and earlier, contains a missing bounds check in its binary decoder. Specifically, the readUint8Array function fails to compare the wire-supplied length against the decoder's own view. This allows an unauthenticated remote peer to perform an...
EUVD-2026-88818
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. readUint8Array never compares the wire-supplied length against the decoder's own view, so on...
CVE-2026-102360
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. "readUint8Array" never compares the wire-supplied length against the decoder's own view, so...
PT-2026-102609
Name of the Vulnerable Software and Affected Versions lib0 versions 0.2.1 through 0.2.117 lib0 versions prior to 1.0.0-rc.33 Description A missing bounds check in the binary decoder allows an unauthenticated remote peer to read adjacent process memory. The readUint8Array function fails to compare...
PT-2026-102610
Name of the Vulnerable Software and Affected Versions lib0 versions prior to 0.2.119 Description The decoder in the readFromDataView function can be manipulated to read beyond the intended buffer boundaries. This allows for the exposure of adjacent process memory, which may contain sensitive...
CVE-2026-102360: Out-of-bounds Read
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. readUint8Array never compares the wire-supplied length against the decoder's own view, so on...