181278 matches found
CVE-2026-111140: Out-of-bounds Read
libregf through 20260526 contains a heap out-of-bounds read in libregfvalueitemreadvaluedata because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacen...
CVE-2026-111139: Out-of-bounds Read
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecodemask that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can...
CVE-2026-111138: Out-of-bounds Read
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmpdecoderle8 and bmpdecoderle4 because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-rea...
CVE-2026-111135: Out-of-bounds Read
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpvolumevaluesreaddata that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump li...
CVE-2026-111133: Out-of-bounds Read
libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...
CVE-2026-111132: Out-of-bounds Read
GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in pathgeometrystartelement that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XP...
CVE-2026-111131: Out-of-bounds Read
libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...
CVE-2026-111130: Out-of-bounds Read
OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slidepositions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts,...
CVE-2026-55871: Improper Neutralization of Special Elements used in an SQL Command
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...
CVE-2026-111127: Out-of-bounds Read
catdoc through 0.95 contains an out-of-bounds read vulnerability in copyunicodestring in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST record...
CVE-2026-111126: Out-of-bounds Read
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of processitem in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2c...
CVE-2026-111125: Out-of-bounds Read
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...
CVE-2026-110876: Out-of-bounds Read
AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before notetable by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read duri...
CVE-2026-111234: External Control of File Name or Path
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...
CVE-2026-111230: External Control of File Name or Path
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...
CVE-2026-111124: Out-of-bounds Read
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compress...
CVE-2026-110877: Out-of-bounds Read
AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...
CVE-2026-108434: Out-of-bounds Read
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...