CWE-125
CVEs classified under CWE-125, newest first.
940 CVEsRSS
CVE-2026-81011Medium· 5.5kernel: platform/x86: hp-bioscfg: pass validated element count to package parsers (CVE-2026-81011)
A flaw was found in the Linux kernel's hp-bioscfg module. The module's package parsers incorrectly determine the number of elements in a package, using a value derived from a name string rather than the true package size. While currently p…
CVE-2026-89466Medium· 5.5⚖ disputedkernel: power: supply: qcom_battmgr: terminate the strings from firmware (CVE-2026-89466)
A flaw was found in the Linux kernel's `qcom_battmgr` component, responsible for power supply management. This vulnerability occurs due to improper string termination when handling firmware-provided strings. A malicious or malformed firmwa…
CVE-2026-89443Medium· 5.5kernel: platform/x86: ISST: Validate level in perf mask ioctls (CVE-2026-89443)
A flaw was found in the Linux kernel's platform/x86 ISST module. The `isst_if_get_perf_level_mask()` and `isst_if_get_base_freq_mask()` functions fail to validate a user-provided 'level' parameter. A local attacker could exploit this by pr…
CVE-2026-89541High· 7.0⚖ disputedkernel: SUNRPC: harden gss_unwrap_resp_priv length checks (CVE-2026-89541)
A flaw was found in the Linux kernel. Specifically, an integer overflow vulnerability exists in the `gss_unwrap_resp_priv()` function within the SUNRPC component. This flaw occurs when validating the length of RPCSEC_GSS opaque data. A mal…
CVE-2026-89532High· 7.0⚖ disputedkernel: svcrdma: Fix pcl_for_each_segment for empty chunks (CVE-2026-89532)
A flaw was found in the Linux kernel's svcrdma component. A remote attacker could send a specially crafted network packet that causes an integer underflow in the `pcl_for_each_segment` function when processing a chunk with zero segments. T…
CVE-2026-89524Medium· 5.5⚖ disputedkernel: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (CVE-2026-89524)
A flaw was found in the ath6kl Wi-Fi driver of the Linux kernel. An integer underflow vulnerability occurs when processing Wi-Fi association requests or responses that are shorter than expected. This can cause the system to read beyond the…
CVE-2026-89596Medium· 5.5kernel: forcedeth: fix off-by-one when saving/restoring non-PCI config space (CVE-2026-89596)
A flaw was found in the Linux kernel's forcedeth driver. An off-by-one error in the `nv_suspend()` and `nv_resume()` functions, which handle saving and restoring non-PCI configuration space, can lead to an out-of-bounds memory access. This…
CVE-2026-89583High· 7.0kernel: Bluetooth: eir: Fix OOB read in eir_get_service_data() (CVE-2026-89583)
A flaw was found in the Linux kernel's Bluetooth subsystem. An out-of-bounds (OOB) read vulnerability exists in the `eir_get_service_data()` function due to incorrect length calculation when parsing Extended Inquiry Response (EIR) advertis…
CVE-2026-89673Medium· 5.5kernel: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (CVE-2026-89673)
A flaw was found in the Linux kernel's NFS daemon (nfsd). A remote attacker could exploit an error in the XDR (External Data Representation) padding calculation within the `ff_encode_getdeviceinfo` function. This mismatch between reserved …
CVE-2026-89657High· 7.0kernel: libceph: validate OSD extent maps before cursor advance (CVE-2026-89657)
A flaw was found in libceph in the Linux kernel. A malicious or compromised authenticated Ceph Object Storage Device (OSD) peer could send a specially crafted sparse-read reply that lacks proper validation of extent maps. This could cause …
CVE-2026-89650High· 7.0⚖ disputedkernel: ceph: bound num_export_targets array for mds info v2/v3 (CVE-2026-89650)
A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph monitor, or an on-path attacker, can send a specially crafted Metadata Server (MDS) map. This map, with an oversized num_export_targets field and a per-MDS…
CVE-2026-89649High· 7.0⚖ disputedkernel: ceph: bound xattr value length in __build_xattrs() (CVE-2026-89649)
A flaw was found in the Linux kernel's Ceph file system (CephFS) component. A malicious or compromised metadata server can manipulate the length of an extended attribute (xattr) value, causing the system to read beyond the intended memory …
CVE-2026-89634High· 7.0⚖ disputedkernel: smb: client: fix ALIGN() overflow in symlink_data() error context loop (CVE-2026-89634)
A flaw was found in the Server Message Block (SMB) client within the Linux kernel. An integer overflow in the ALIGN() function, specifically within the symlink_data() error context loop, can lead to an out-of-bounds read. This issue allows…
CVE-2026-89621Medium· 5.5kernel: HID: mcp2221: validate report size in mcp2221_raw_event() (CVE-2026-89621)
A flaw was found in the Linux kernel's HID (Human Interface Device) mcp2221 driver. A malicious USB device can exploit this vulnerability by sending a specially crafted, short HID report with an invalid size. This can cause the system to r…
CVE-2026-89730Medium· 5.5kernel: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (CVE-2026-89730)
A flaw was found in the `altera-cvp` FPGA driver within the Linux kernel. The `altera_cvp_send_block()` function can perform an out-of-bounds read when processing the trailing bytes of an input buffer. This occurs if the buffer ends at a p…
CVE-2026-89726Medium· 5.5kernel: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (CVE-2026-89726)
A flaw was found in the Linux kernel's `ucs2_strnlen()` function. This vulnerability occurs because the function checks the current character before verifying if the maximum allowed length has been reached. If the input string is not prope…
CVE-2026-89720Medium· 5.5⚖ disputedkernel: ubifs: fix out-of-bounds read in signature length check (CVE-2026-89720)
A flaw was found in the Linux kernel's Unsorted Block Image File System (UBIFS). An incorrect bounds check in the ubifs_sb_verify_signature() function allows a crafted signed UBIFS image to declare a signature length larger than its actual…
CVE-2026-80964Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe
In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's O…
CVE-2026-89721Medium· 5.5kernel: phy: rockchip-samsung-dcphy: fix out-of-range max_register (CVE-2026-89721)
A flaw was found in the Linux kernel's `phy: rockchip-samsung-dcphy` component. A local attacker with access to the `regmap debugfs` interface could trigger an out-of-bounds read by attempting to dump registers. This occurs because the `ma…
CVE-2026-89700Medium· 4.7In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listener_set nfsd_sock_nl_policy declares NFSD_A_SOCK_ADDR as a bare NLA_BINARY attribute with no minimum length
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listener_set nfsd_sock_nl_policy declares NFSD_A_SOCK_ADDR as a bare NLA_BINARY attribute with no minimum length. A CAP_NE…
CVE-2026-89698Medium· 6.5In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain "struct sockaddr" (16 bytes)
In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain "struct sockaddr" (16 bytes). When an IPv…
CVE-2026-89629Medium· 5.5kernel: HID: corsair-void: Check size of status and firmware events before reading them (CVE-2026-89629)
A flaw was found in the Linux kernel, specifically within the `corsair-void` driver for Human Interface Devices (HID). This vulnerability allows an attacker to cause an out-of-bounds read by sending malformed status and firmware events. Th…
CVE-2026-78546Medium· 4.8Out-of-bounds read vulnerability in Citirx Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.
Out-of-bounds read vulnerability in Citirx Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.
CVE-2026-13326Medium· 6.9An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.
An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.
CVE-2026-89162Low· 2.9In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
CVE-2026-89160Low· 3.7PoCPCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
CVE-2026-89156Low· 2.9PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
CVE-2026-88054Medium· 5.5PoCTesseract is an open source OCR engine
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED laye…
CVE-2026-88015Medium· 5.3PoCrclone is a command-line program to sync files and directories to and from different cloud storage providers
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.De…
CVE-2026-79592High· 7.5PoCAn out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets.
An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets.