CVE-2026-127916 MCUboot image hash span is not bounded against the slot, allowing a read past the flash area during image validation

The MCUboot bootloader contains a vulnerability in bootutil_img_hash() where the image hash calculation spans a memory range that is not bounded against the flash slot. This occurs because the function sums ih_hdr_size, ih_img_size, and ih_protect_tlv_size from the image header without overflow c...

CVE-2026-127915 TLV iterator does not bound each entry against the declared TLV area in MCUboot bootutil

The MCUboot bootloader contains an out-of-bounds read vulnerability in the bootutil_tlv_iter_next() function within boot/bootutil/src/tlv.c. The iterator fails to validate that the header and payload of each TLV entry stay within the declared tlv_end boundary, potentially allowing it to read up t...

CVE-2026-16664 Unchecked serial-recovery image index causes out-of-bounds slot-table read in MCUboot Zephyr port

The MCUboot bootloader's Zephyr port contains an out-of-bounds read (CWE-192) in the bs_upload() handler within boot/boot_serial/src/boot_serial.c. The vulnerability occurs because the host-supplied img_num from an MCUmgr image-upload request is processed without a range check before being used t...

mackron dr_libs dr_mp3 drmp3_init_internal out-of-bounds read vulnerability

Summary A out-of-bounds read vulnerability exists in the drmp3 drmp3initinternal functionality of drlibs versions: 0.7.3. A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability. Confirmed Vulnerable Versions The...

Active Storage: Possible arbitrary file write and read in image analysis

Impact A Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include...

EUVD-2026-116914

Active Storage: Possible arbitrary file write and read in image analysis...

CVE-2026-46674

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, an out-of-bounds read vulnerability exists in bacnet-stack's AtomicWriteFile record-access path. The bug is caused by a mismatch between an externally controlled...

CVE-2026-46677

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a remote returnedRecordCount value and...

CVE-2026-45265

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a stack-based out-of-bounds write / stack-buffer-overflow in bacnet-stack when the server processes a malicious Atomic-Read-File request in record access mode. The bug i...

CVE-2026-0455

The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit XPPU for the inter-processor interrupt IPI buffers does not block unauthorized access as expected. This allows processors in the SoC with any IPI channel access the ability to both read and write to the entire IPI buffer register space a...

CVE-2024-21963

An out-of-bounds read vulnerability in the IOMMU could allow a malicious guest to corrupt hypervisor HV pages and potentially cause a host crash leading to loss of availability...

Important: Red Hat Security Advisory: libXtst security update

An update for libXtst is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser

A flaw was found in libXtst. An out-of-bounds read vulnerability in the RECORD extension reply parser allows a malicious X server to cause a Denial of Service DoS by crashing connected client applications. Under certain conditions, this flaw may also result in limited information disclosure...

CVE-2026-107152 Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed

An improper authentication vulnerability has been found in the task console in the smartproxydynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or us...

EUVD-2026-124668

An improper authentication vulnerability has been found in the task console in the smartproxydynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or us...

CVE-2026-107152

The smart_proxy_dynflow package contains an improper authentication vulnerability in its task console. The console incorrectly accepts any client certificate signed by the capsule's certificate authority without verifying if the certificate belongs to a trusted server. A low-privileged network at...

CVE-2026-107152

An improper authentication vulnerability has been found in the task console in the smartproxydynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or us...

CVE-2026-46677

The BACnet Stack , an open-source BACnet protocol stack C library for embedded systems, contains a client-side out-of-bounds read vulnerability in the AtomicReadFile-ACK record-access handling path. This flaw exists in versions prior to 1.4.4 and 1.5.1 due to a mismatch between a remote returnedR...

CVE-2026-46674

The BACnet Stack open source protocol stack C library for embedded systems is vulnerable to an out-of-bounds read vulnerability in the AtomicWriteFile record-access path. This flaw is caused by a mismatch between an externally controlled returnedRecordCount field and the fixed-size internal fileD...

EUVD-2026-124658

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, an out-of-bounds read vulnerability exists in bacnet-stack's AtomicWriteFile record-access path. The bug is caused by a mismatch between an externally controlled...