# CWE-126.

Every Advisory and CVE whose sources give the weakness CWE-126, newest first.

## Records, newest first

- [X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read](https://agentprime.io/advisories/CVE-2026-93524.md)
  `CVE-2026-93524` · CVE record: x.org xorg-x11-server and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-126
- [Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser](https://agentprime.io/advisories/CVE-2026-57185.md)
  `CVE-2026-57185` · CVE record: asterisk asterisk and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-126, CWE-170
- [odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()](https://agentprime.io/advisories/CVE-2026-55606.md)
  `CVE-2026-55606` · CVE record: openwrt odhcpd · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-126
- [odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure](https://agentprime.io/advisories/CVE-2026-53920.md)
  `CVE-2026-53920` · CVE record: openwrt odhcpd · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Memory corruption, Information disclosure, CWE-126
- [Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size](https://agentprime.io/advisories/GHSA-4558-3h8r-v8xp.md)
  `GHSA-4558-3h8r-v8xp`, `BIT-pillow-2026-112394`, `CVE-2026-112394`, `PYSEC-2026-4327` · PyPI `pillow`: affected `<13.0.0`, fixed in `13.0.0` · CVSS 6.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-126
- [Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels](https://agentprime.io/advisories/GHSA-c6hw-5grf-ff96.md)
  `GHSA-c6hw-5grf-ff96`, `BIT-pillow-2026-112404`, `CVE-2026-112404` · PyPI `pillow`: affected `>=8.1.0, <13.0.0`, fixed in `13.0.0` · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption, CWE-126
- [info leak uploading over WebSockets with GnuTLS](https://agentprime.io/advisories/CVE-2026-107928.md)
  `CVE-2026-107928` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-126
- [MariaDB: Out-of-bound buffer read on in \`ST_Area\` of a multipolygon.](https://agentprime.io/advisories/CVE-2026-85745.md)
  `CVE-2026-85745` · CVE record: MariaDB server · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-126
- [An issue was discovered in GStreamer gst-plugins-good before 1.28.2.](https://agentprime.io/advisories/CVE-2026-46471.md)
  `CVE-2026-46471` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-126
- [Microsoft Office PowerPoint Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-108454.md)
  `CVE-2026-108454` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-126
- [Multiple vulnerabilities in bhyve device models](https://agentprime.io/advisories/CVE-2026-101310.md)
  `CVE-2026-101310` · CVE record: FreeBSD FreeBSD · CVSS 7.0 High · Not analysed yet · Published 15 Oct 2026 · Tags: Race condition, Memory corruption, CWE-126
- [Role: DNS Server Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-97828.md)
  `CVE-2026-97828` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows Broadcast DVR User Service Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-103567.md)
  `CVE-2026-103567` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Microsoft Office Excel Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-88195.md)
  `CVE-2026-88195` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption, CWE-126
- [Windows GDI Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69884.md)
  `CVE-2026-69884` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows StateRepository API Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-85910.md)
  `CVE-2026-85910` · CVE record: Microsoft Windows 11 Version 24H2 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows Common Log File System Driver Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83835.md)
  `CVE-2026-83835` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure, CWE-126
- [Windows rndismp6.sys Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83788.md)
  `CVE-2026-83788` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 4.6 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-83685.md)
  `CVE-2026-83685` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows Encrypting File System (EFS) Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83565.md)
  `CVE-2026-83565` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows Event Logging Service Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-95904.md)
  `CVE-2026-95904` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows Management Instrumentation Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-96851.md)
  `CVE-2026-96851` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows Win32 Kernel Subsystem Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-96848.md)
  `CVE-2026-96848` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Microsoft Office Excel Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-88201.md)
  `CVE-2026-88201` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Microsoft Office Word Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-88167.md)
  `CVE-2026-88167` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows USB Driver Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-85935.md)
  `CVE-2026-85935` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows CD-ROM Driver Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83888.md)
  `CVE-2026-83888` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows CD-ROM Driver Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-70041.md)
  `CVE-2026-70041` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Servicing Stack Updates Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-85835.md)
  `CVE-2026-85835` · CVE record: Microsoft Windows 11 Version 24H2 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows Overlay Filter Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83727.md)
  `CVE-2026-83727` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Servicing Stack Updates Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83719.md)
  `CVE-2026-83719` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Desktop Window Manager Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-70234.md)
  `CVE-2026-70234` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows Overlay Filter Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69957.md)
  `CVE-2026-69957` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption, CWE-126
- [Windows Overlay Filter Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-69954.md)
  `CVE-2026-69954` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows Overlay Filter Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69953.md)
  `CVE-2026-69953` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows Overlay Filter Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69950.md)
  `CVE-2026-69950` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [Windows Overlay Filter Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-69942.md)
  `CVE-2026-69942` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-126
- [canva affinity: The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform…](https://agentprime.io/advisories/CVE-2026-101130.md)
  `CVE-2026-101130` · CVE record: canva affinity · CVSS 3.6 Low · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-126
- [canva affinity: The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly…](https://agentprime.io/advisories/CVE-2026-101094.md)
  `CVE-2026-101094` · CVE record: canva affinity · CVSS 3.6 Low · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-126
- [canva affinity: The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not…](https://agentprime.io/advisories/CVE-2026-96394.md)
  `CVE-2026-96394` · CVE record: canva affinity · CVSS 2.9 Low · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-126
- [Buffer Over-read in WLAN HAL](https://agentprime.io/advisories/CVE-2026-57546.md)
  `CVE-2026-57546` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-126
- [In Modem, there is a possible out of bounds read due to a missing permission check.](https://agentprime.io/advisories/CVE-2026-20541.md)
  `CVE-2026-20541` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-126
- [In Modem, there is a possible out of bounds read due to a missing bounds check.](https://agentprime.io/advisories/CVE-2026-20540.md)
  `CVE-2026-20540` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-126
- [In Modem, there is a possible out of bounds read due to a missing bounds check.](https://agentprime.io/advisories/CVE-2026-20539.md)
  `CVE-2026-20539` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-126
- [In Modem, there is a possible out of bounds read due to a missing permission check.](https://agentprime.io/advisories/CVE-2026-20538.md)
  `CVE-2026-20538` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-126
- [Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)](https://agentprime.io/advisories/CVE-2026-102728.md)
  `CVE-2026-102728` · CVE record: Eclipse Foundation Eclipse ThreadX NetX Duo · CVSS 6.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-126
- [The \`\_nx_secure_x509_asn1_tlv_block_parse()\` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data.](https://agentprime.io/advisories/CVE-2026-102758.md)
  `CVE-2026-102758` · CVE record: Eclipse Foundation NetX Duo · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-126
- [Buffer Over-read in Wireshark](https://agentprime.io/advisories/CVE-2026-95392.md)
  `CVE-2026-95392` · CVE record: Wireshark Foundation Wireshark · CVSS 5.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-126
- [Buffer Over-read in Wireshark](https://agentprime.io/advisories/CVE-2026-96420.md)
  `CVE-2026-96420` · CVE record: Wireshark Foundation Wireshark · CVSS 4.7 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-126
- [One-byte overread in strncasecmp on Power8](https://agentprime.io/advisories/CVE-2026-97399.md)
  `CVE-2026-97399` · CVE record: The GNU C Library glibc · CVSS 3.7 Low · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-126
- [Out-of-bounds read in libXtst's RECORD reply parser](https://agentprime.io/advisories/CVE-2026-94286.md)
  `CVE-2026-94286` · CVE record: x.org libXtst · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-126
- [Apache Tomcat Native: DoS via TLS handshake](https://agentprime.io/advisories/CVE-2026-86243.md)
  `CVE-2026-86243` · CVE record: Apache Software Foundation Apache Tomcat Native · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-126
- [Buffer Over-read in WLAN Firmware](https://agentprime.io/advisories/CVE-2026-25294.md)
  `CVE-2026-25294` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.4 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-126
- [Buffer Over-read in OOBM](https://agentprime.io/advisories/CVE-2026-25284.md)
  `CVE-2026-25284` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.3 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-126
- [Buffer Over-read in WLAN Firmware](https://agentprime.io/advisories/CVE-2026-25275.md)
  `CVE-2026-25275` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.5 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-126
- [Buffer Over-read in BT Controller](https://agentprime.io/advisories/CVE-2026-24081.md)
  `CVE-2026-24081` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.4 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-126
- [Buffer Over-read in Qualcomm IPC](https://agentprime.io/advisories/CVE-2026-24075.md)
  `CVE-2026-24075` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-126
- [GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-read](https://agentprime.io/advisories/CVE-2026-90610.md)
  `CVE-2026-90610` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption, CWE-126
- [Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600](https://agentprime.io/advisories/CVE-2026-76653.md)
  `CVE-2026-76653` · CVE record: TP-Link Systems Inc. TL-MR6400 v8 and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-126
- [Microsoft Office Word Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83949.md)
  `CVE-2026-83949` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-126

Older: <https://agentprime.io/advisories/tag/cwe-126.md?cursor=WyIyMDI2LTA5LTA4VDE3OjE5OjE0LjI0ODAwMFoiLCJDVkUtMjAyNi04Mzk0OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-126>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-126/>. Everything for agents: <https://agentprime.io/llms.txt>.