CVE Database

CVE-2026-111142 Medium · 5.5 CWE-125 Oct 15, 2026

Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst

Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.

CVE-2026-111141 Medium · 4.7 CWE-125 Oct 15, 2026

zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing

zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.

CVE-2026-111140 Medium · 6.1 CWE-125 Oct 15, 2026

libregf through 20260526 Heap Out-of-Bounds Read via libregf_value_item_read_value_data

libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacent heap bytes or crash parsers like regfexport and plaso.

CVE-2026-111139 Medium · 5.5 CWE-125 Oct 15, 2026

NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmp_decode().

CVE-2026-111138 Medium · 5.5 CWE-125 Oct 15, 2026

NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read in RLE8 and RLE4 Decoders

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.

CVE-2026-111135 Medium · 6.1 CWE-125 Oct 15, 2026

libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag to crash consuming processes.

CVE-2026-111134 Medium · 6.1 CWE-125 Oct 15, 2026

libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_file_entry_values_read_data

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers.

CVE-2026-111133 Medium · 6.1 CWE-125 Oct 15, 2026

libfsapfs through 20260921 Heap Out-of-Bounds Read via libfsapfs_key_encrypted_key_read_data

libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash fsapfsinfo, pyfsapfs, dfVFS or plaso and read adjacent heap memory before password checks.

CVE-2026-111132 Medium · 6.1 CWE-125 Oct 15, 2026

GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element

GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.

CVE-2026-111131 Medium · 6.1 CWE-125 Oct 15, 2026

libxmp through 4.7.4 Stack Out-of-Bounds Read via P61A Depacker

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sample metadata or disrupt loading.

CVE-2026-111130 Medium · 6.1 CWE-125 Oct 15, 2026

OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position

OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts, crashing applications that open it and corrupting tile geometry.

CVE-2026-111127 Medium · 6.1 CWE-125 Oct 15, 2026

catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string

catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process.

CVE-2026-111126 Medium · 6.1 CWE-125 Oct 15, 2026

catdoc through 0.95 Out-of-Bounds Read in xls2csv MULRK Record Handler

catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2csv to disclose adjacent process memory as CSV cells or crash the process.

CVE-2026-111125 High · 7.1 CWE-125 Oct 15, 2026

CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.

CVE-2026-111124 High · 7.1 CWE-125 Oct 15, 2026

CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.

CVE-2026-110877 Medium · 5.5 CWE-125 Oct 15, 2026

AdPlug through 2.4 Heap Out-of-Bounds Read via CdmoLoader::load

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packed_module and potentially crash the application.

CVE-2026-110876 Medium · 5.5 CWE-125 Oct 15, 2026

AdPlug through 2.4 Out-of-Bounds Read via CxsmPlayer::play_note in XSM Files

AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback that may crash affected applications.

CVE-2026-79843 Medium · 6.5 CWE-125 Oct 15, 2026

HPE NonStop SQL/MX EXE - out-of-bounds read vulnerability

A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption.

CVE-2026-101290 High · 7.5 CWE-125 Oct 15, 2026

CVE-2026-101290

A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-service condition.

CVE-2026-58100 High · 7.0 CWE-125 Oct 15, 2026

Memory safety bugs in kqueue copy-on-fork implementation

kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges.

CVE-2026-76667 Medium · 5.7 CWE-125 Oct 15, 2026

HPE NonStop EXPAND - Out-of-Bounds memory read vulnerability

A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.

CVE-2026-76666 Medium · 4.7 CWE-125 Oct 15, 2026

HPE NonStop EXPAND - Out-of-Bounds memory read

A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.

CVE-2026-76665 High · 7.1 CWE-125 Oct 15, 2026

HPE NonStop EXPAND - Buffer Overflow vulnerability

A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.

CVE-2026-76664 Medium · 6.4 CWE-125 Oct 15, 2026

HPE NonStop EXPAND - Out-of-Bounds memory read/write

A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations

CVE-2026-73260 High · 7.5 CWE-125 Oct 14, 2026

Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the handshake. This issue is fixed in version 7.23.