VVdeC before 3.2.1 has heap out-of-bounds read (CVE-2026-124309)
Parsing a scalable-nesting SEI can read past a heap buffer; the local bug is rated CVSS 6.1.
Stories per day · 30 days
2 RSS
Relatedgame-engine2godot2memory-safety2ac-41coretext1cve-2026-1107361disputed-cve1ecu1embedded1gif1gpac1heap1heap-oob1ics1imager1information-disclosure1macos1microsoft1
25 stories, newest first · one card per story
Stories tagged #out-of-bounds-read
Microsoft patches Windows Paint local RCE flaw CVE-2026-83844
The out-of-bounds read needs local access and user interaction; Microsoft rates exploitation less likely.
1
macOS CoreText out-of-bounds read can disclose information
CVE-2026-112656 is scored CVSS 3.3 and requires opening a malicious page or file.
GPAC MP4Box out-of-bounds read on crafted AC-4 (CVE-2025-71438)
A stream-supplied frame_rate_index indexes fixed lookup tables; the snippet states no fix or affected build.
Siemens Capital Embedded AR Classic has remote out-of-bounds read
R20-11 is fixed in V2303, while all 431-422 builds have no planned fix and should stay behind firewalls.
Imager::File::GIF before 1.006 allows out-of-bounds GIF reads
Stig Palmquist reported the Perl module issue to oss-security on October 20.
Re: Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup
Disputed CVE-2026-110736 covers a Godot 4.x heap out-of-bounds read scored CVSS 3.6.
Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup
Unpatched Godot 4.x heap out-of-bounds read affects OptimizedTranslation parsing of untrusted files.
[NotCVE-2026-0018] game-music-emu (libgme) through 0.6.5 Unbounded GYM Command Loop Allows Heap Out-of-Bounds Read
libgme through 0.6.5 can leak heap memory when playing a crafted GYM file.
OpenSSL High-Severity Flaw Lets Attackers Leak Heap Memory in Plaintext
OpenSSL patched high-severity CVE-2026-84782, a DTLS out-of-bounds read that can leak heap memory or crash services.
[NotCVE-2026-0019] game-music-emu through 0.6.5 VGM Command Interpreter Missing Operand Length Check Allows Heap Out-of-Bounds Read
game-music-emu through 0.6.5 can leak heap memory when parsing a crafted VGM or VGZ file.
ZDI-26-745: Foxit PDF Reader AcroForm Out-of-Bounds Read Remote Code Execution Vulnerability
Foxit PDF Reader AcroForm out-of-bounds read may allow remote code execution with user interaction.
CVE-2026-74765: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode
Perl Net::IDN::Punycode before 2.590 allows an out-of-bounds read via delta overflow in encode_punycode.
CVE-2026-73638: Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd
Perl image library Imager before 1.035 reads outside the EXIF block via unchecked start offsets in tiff_load_ifd, fixed in 1.035.
ZDI-26-701: Linux Kernel TLS Protocol Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI discloses Linux Kernel TLS protocol out-of-bounds read (CVE-2026-64046) allowing high-privileged local attackers to disclose sensitive information, CVSS 6.7.
ZDI-26-697: Linux Kernel NTFS3 Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI-26-697: Linux Kernel NTFS3 out-of-bounds read rated CVSS 7.3 lets local low-privileged attackers disclose sensitive information.
Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory
Two VLC 3.0 flaws, CVE-2026-56711 (heap corruption, CVSS 8.6) and CVE-2026-73324 (memory leak), let crafted PNGs or RTSP playlists corrupt memory or leak data.
4
ZDI-26-669: Adobe Acrobat Reader DC JBIG2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI advisory ZDI-26-669 details an out-of-bounds read (CVE-2026-81978) when Adobe Acrobat Reader DC parses JBIG2 files.
ZDI-26-631: NI LabVIEW VI File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI disclosed CVE-2026-18444, an out-of-bounds read in NI LabVIEW VI file parsing that can disclose sensitive information, rated CVSS 3.3.
ZDI-26-642: Oracle VirtualBox IDisplay Out-Of-Bounds Read Local Privilege Escalation Vulnerability
ZDI publishes ZDI-26-642 for CVE-2026-60159, an out-of-bounds read local privilege escalation in Oracle VirtualBox IDisplay, rated CVSS 7.5.
Vulnerabilities fixed in libxml2-2.15.4
libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.
ZDI-26-611: (0Day) pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability
ZDI published ZDI-26-611, an unpatched out-of-bounds read in pdfforge PDF Architect App Object enabling remote code execution (CVSS 7.8).
Mitsubishi Electric CNC Series (Update A)
CISA's updated ICS advisory details CVE-2025-2399, an out-of-bounds read in Mitsubishi Electric CNC series that lets a remote attacker cause a denial-of-service condition.
ZDI-26-596: Foxit PDF Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Foxit PDF Reader out-of-bounds read in PDF parsing (CVE-2026-57253, CVSS 3.3) can leak sensitive information via malicious files.