CWE-126
CWE-126 · 53 records · 10 with a public proof-of-concept
Records the NVD classes under CWE-126, highest CVSS first.
- HIGH 7.8CVE-2026-83727
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-69957
Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-69953
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-69950
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-69942
Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.
windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h1 · windows 11 26h2 · windows server 2022
- HIGH 7.8CVE-2026-69884
Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.
- HIGH 7.5CVE-2026-57546
Transient DOS when processing a continuous receive command with a zero-sized global configuration override.
congo firmware · congo · fastconnect 7800 firmware · fastconnect 7800 · orne firmware · orne
- HIGH 7.5CVE-2026-102758public PoC
The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer …
- HIGH 7.5CVE-2026-102728public PoC
Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a T…
- HIGH 7.5CVE-2026-86243
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported ver…
- HIGH 7.4CVE-2026-25288
Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.
orne firmware · orne · palawan25 firmware · palawan25 · pandeiro firmware · pandeiro
- HIGH 7.1CVE-2026-94286
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
- HIGH 7CVE-2026-101310
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by th…
- MEDIUM 6.5CVE-2026-57185public PoC
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the `PJSIP …
- MEDIUM 6.5CVE-2026-55606public PoC
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endia…
- MEDIUM 6.5CVE-2026-108454
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-97828
Buffer over-read in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-88201
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88195
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-88167
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-83888
Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.
- MEDIUM 6.5CVE-2026-83685
Buffer over-read in Windows IKE Extension allows an authorized attacker to deny service over a network.
- MEDIUM 5.5CVE-2026-46471public PoC
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.
- MEDIUM 5.5CVE-2026-96851
Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-96848
Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows server 2019 · windows server 2022
- MEDIUM 5.5CVE-2026-95904
Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-85935
Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-85910
Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-85835
Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83835
Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83719
Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83565
Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70234
Buffer over-read in Desktop Window Manager allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70041
Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-69954
Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-103567
Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-95392
MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- MEDIUM 5.3CVE-2026-20541
In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User inte…
- MEDIUM 5.3CVE-2026-20540
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interact…
- MEDIUM 5.3CVE-2026-20539
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interact…
- MEDIUM 5.3CVE-2026-20538
In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User inte…
- MEDIUM 4.8CVE-2026-124317public PoC
libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the c…
- MEDIUM 4.7CVE-2026-96420
Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- MEDIUM 4.6CVE-2026-83788
Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack.
- MEDIUM 4.3CVE-2026-85745public PoC
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser ad…
- LOW 3.7CVE-2026-97399
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the…
- LOW 3.6CVE-2026-101130
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, …
- LOW 3.6CVE-2026-101094
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity documen…
- LOW 2.9CVE-2026-96394
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap …
- UNSCOREDCVE-2026-93524
A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server.
- UNSCOREDCVE-2026-53920public PoC
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header t…
- UNSCOREDCVE-2026-112404public PoC
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretatio…
- UNSCOREDCVE-2026-112394public PoC
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply a…