Export limit exceeded: 424405 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 12014 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (12014 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121093 | 1 Google | 1 Chrome | 2026-11-09 | 5.7 Medium |
| Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-125194 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 5.5 Medium |
| FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing the loop counter to wrap and crash the transcoding process. | ||||
| CVE-2026-100126 | 3 Adobe, Apple, Microsoft | 4 Adobe Bridge, Bridge, Macos and 1 more | 2026-11-09 | 5.5 Medium |
| Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-100130 | 3 Adobe, Apple, Microsoft | 3 Substance 3d Sampler, Macos, Windows | 2026-11-09 | 5.5 Medium |
| Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-100131 | 3 Adobe, Apple, Microsoft | 3 Substance 3d Sampler, Macos, Windows | 2026-11-09 | 5.5 Medium |
| Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-87041 | 1 Zephyrproject | 1 Zephyr | 2026-11-09 | 7.8 High |
| The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated the results of K_SYSCALL_MEMORY() into its valid_sqe flag with &=. That macro returns nonzero on failure (it is built on K_SYSCALL_VERIFY_MSG(), which yields !(expr)), so every buffer permission check contributed the opposite of its result. A submission whose tx.buf, rx.buf or txrx.tx_buf/txrx.rx_buf pointer was not accessible to the calling thread was accepted, while a legitimate, thread-owned buffer caused the calling thread to be killed with a kernel oops. The verifier runs on behalf of the rtio_sqe_copy_in_get_handles() system call (also reached through the inline rtio_sqe_copy_in() wrapper), so it is driven directly by untrusted user-mode input on any image built with CONFIG_USERSPACE. A user thread that has been granted an RTIO context and an rtio_iodev object — the intended usage of RTIO userspace support, established via rtio_access_grant() — can submit an SQE whose buffer pointer and length name arbitrary kernel memory; the object check on sqe->iodev is unaffected and still passes, and the crafted SQE is forwarded to the bus driver unchanged. Downstream consumers dereference the pointer with supervisor privilege. The generic I2C and I3C RTIO fallback handlers (drivers/i2c/i2c_rtio_default.c, drivers/i3c/i3c_rtio_default.c) copy sqe.rx.buf/sqe.tx.buf into struct i2c_msg and call i2c_transfer(), and the vendor SPI/I2C RTIO drivers behave equivalently. An RTIO_OP_RX submission therefore has peripheral data written into kernel memory of the attacker's choosing (arbitrary kernel write), an RTIO_OP_TX submission clocks kernel memory out over the bus (kernel memory disclosure), and a pointer to unmapped memory faults the kernel. This is a full escape from the user-mode isolation boundary that CONFIG_USERSPACE exists to enforce. The defect was masked for years because the in-tree user-mode RTIO tests only exercise RTIO_OP_NOP and mempool-backed reads, neither of which reaches the affected checks. The fix negates each K_SYSCALL_MEMORY() result and additionally validates the TXRX transmit buffer read-only, matching the SPI, I2C and I3C handlers. | ||||
| CVE-2026-123805 | 1 Sipsorcery-org | 1 Sipsorcery | 2026-11-09 | 7.5 High |
| SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated WebRTC peer can send a checksum-valid malformed SACK chunk that drives the parser beyond the 262144-byte receive buffer. The resulting IndexOutOfRangeException bypasses the recoverable ApplicationException handler in RTCSctpTransport.DoReceive, causing the generic handler to exit the dedicated receive loop and permanently terminate the SCTP association and all data channels. This issue is fixed in 10.0.14. | ||||
| CVE-2026-121160 | 1 Google | 1 Chrome | 2026-11-09 | 7.4 High |
| Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-124996 | 1 Turboderp-org | 1 Exllamav3 | 2026-11-09 | 6.3 Medium |
| A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routing_sel_norm_kernel of the file exllamav3/exllamav3_ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2eid causes out-of-bounds read. Remote exploitation of the attack is possible. Upgrading to version 1.6.4 is sufficient to resolve this issue. Patch name: c9a57ae832a3035e264e0a412e1daf4ebb699b98. Upgrading the affected component is recommended. | ||||
| CVE-2025-9232 | 2 Openssl, Siemens | 42 Openssl, Ruggedcom Rst2428p, Ruggedcom Rst2428p Firmware and 39 more | 2026-11-09 | 5.9 Medium |
| Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary. | ||||
| CVE-2025-9230 | 3 Debian, Openssl, Siemens | 40 Debian Linux, Openssl, Ruggedcom Rst2428p and 37 more | 2026-11-09 | 9.8 Critical |
| Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. | ||||
| CVE-2026-124994 | 1 Turboderp-org | 1 Exllamav3 | 2026-11-09 | 6.3 Medium |
| A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file exllamav3/exllamav3_ext/ngram.cu of the component NGramEmbedding. The manipulation of the argument head_bias results in out-of-bounds read. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.4 is sufficient to fix this issue. The patch is identified as c9a57ae832a3035e264e0a412e1daf4ebb699b98. It is suggested to upgrade the affected component. | ||||
| CVE-2026-80490 | 2026-11-09 | 4.4 Medium | ||
| Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified. The matches, first_match and match_details methods use the T_STD_STRING typemap to translate Perl scalars (SVs) into strings via the std::string constructor, using the SvPV macro to stringify the haystack input, and the SvCUR macro to determine the length of the SV. When the input SVs are references, integers (IVs) or floats (NVs), the SvCUR macro will return an invalid length if it is run before the input is stringified, leading to an out-of-bounds read which can abort the process. Note that the evaluation order of arguments to std::string is unspecified. Depending on the compiler, SvCUR may be run first and lead to an abort that cannot be caught within Perl. This can be triggered when the haystack is a numeric value, for example, my $ac = Algorithm::AhoCorasick::XS->new( [ "11", "22" ] ); $ac->matches( 211 ); This can occur when the haystack is the result of reading data from decoded JSON or a numeric database column. It can also be triggered when using a blessed object as a haystack. | ||||
| CVE-2026-125270 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 5.3 Medium |
| FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or leaking heap memory into encoded output. | ||||
| CVE-2026-125261 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 6.1 Medium |
| FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorotate vflip, so transcoding to SGI images reads pixel data far outside the frame and crashes the process. | ||||
| CVE-2026-125228 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 5.3 Medium |
| FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds read vulnerability in put_vector() in libavcodec/vorbisenc.c when NaN samples leave the codebook entry at -1. Attackers can supply audio with NaN float samples to the native Vorbis encoder, causing heap reads before arrays that crash the application or leak adjacent heap memory into output. | ||||
| CVE-2026-125211 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 7 High |
| FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaption_trans_ass_subtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using region_count instead of num_rects. Attackers can supply crafted ARIB captions whose later region exceeds the 8 KiB AVBPrint limit, triggering cleanup that frees out-of-bounds pointers and corrupts the heap. | ||||
| CVE-2026-125193 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 6.1 Medium |
| FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpacked_decode_uyvy422() in libavcodec/bitpacked_dec.c because it never verifies packets hold width * height * 2 bytes. Attackers can supply truncated bitpacked UYVY422 packets via crafted SDP/RFC 4175 RTP sessions or raw input to crash applications or expose adjacent heap memory. | ||||
| CVE-2026-125182 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 3.3 Low |
| FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because cook_decode_init() does not check js_subband_start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decode_buffer_0, leaking pointers and decoder state into decoded audio to help defeat ASLR. | ||||
| CVE-2026-125178 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 6.1 Medium |
| FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc_paint_cursor() reads past the cursor buffer, crashing the decoder or leaking heap memory into frames. | ||||