# CWE-126.

Every Advisory and CVE whose sources give the weakness CWE-126, newest first.

## Records, newest first (an older page)

- [An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path](https://agentprime.io/advisories/CVE-2026-50813.md)
  `CVE-2026-50813` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-126
- [Buffer Over-read in Windows Compute](https://agentprime.io/advisories/CVE-2026-21379.md)
  `CVE-2026-21379` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-126
- [Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"](https://agentprime.io/advisories/CVE-2026-58013.md)
  `CVE-2026-58013` · CVE record: GNOME GLib and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-126
- [Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()](https://agentprime.io/advisories/CVE-2026-58012.md)
  `CVE-2026-58012` · CVE record: GNOME GLib and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-126
- [Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()](https://agentprime.io/advisories/CVE-2026-58010.md)
  `CVE-2026-58010` · CVE record: GNOME GLib and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-126
- [Global Buffer Overflow in GNU gzip](https://agentprime.io/advisories/CVE-2026-41992.md)
  `CVE-2026-41992` · CVE record: GNU gzip · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-126
- [Out-of-bounds read in SetMacAddrAction](https://agentprime.io/advisories/CVE-2026-40210.md)
  `CVE-2026-40210` · CVE record: PowerDNS DNSdist · CVSS 4.8 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-126
- [Tornado has out-of-bounds memory access via C extension](https://agentprime.io/advisories/GHSA-cx3h-4qpv-8hc9.md)
  `GHSA-cx3h-4qpv-8hc9`, `CVE-2026-49854`, `PYSEC-2026-3388` · PyPI `tornado`: affected `<6.5.6`, fixed in `6.5.6` · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-126
- [Windows Projected File System Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-42828.md)
  `CVE-2026-42828` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-126
- [Microsoft Office Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-45460.md)
  `CVE-2026-45460` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-126
- [389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing](https://agentprime.io/advisories/CVE-2026-11787.md)
  `CVE-2026-11787` · CVE record: Red Hat Red Hat Directory Server 11 and 4 more · CVSS 5.0 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-126
- [Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP \`send_request\`](https://agentprime.io/advisories/CVE-2026-44185.md)
  `CVE-2026-44185` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.3 High · Not analysed yet · Published 8 Jun 2026 · Tags: Memory corruption, CWE-126
- [Buffer Over-read in WLAN Host Communication](https://agentprime.io/advisories/CVE-2025-59609.md)
  `CVE-2025-59609` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 5.5 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-126
- [scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()](https://agentprime.io/advisories/CVE-2026-46149.md)
  `CVE-2026-46149` · CVE record: Linux Linux · CVSS 7.1 High · Not analysed yet · Published 28 May 2026 · Tags: CWE-126
- [slip: bound decode() reads against the compressed packet length](https://agentprime.io/advisories/CVE-2026-45843.md)
  `CVE-2026-45843` · CVE record: Linux Linux · CVSS 8.2 High · Not analysed yet · Published 27 May 2026 · Tags: CWE-126
- [Gnutls: gnutls: information disclosure via heap overread in rsa key exchange](https://agentprime.io/advisories/CVE-2026-5260.md)
  `CVE-2026-5260` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.2 High · Not analysed yet · Published 26 May 2026 · Tags: CWE-126
- [OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers](https://agentprime.io/advisories/GHSA-vvmg-8mjr-g6q3.md)
  `GHSA-vvmg-8mjr-g6q3`, `CVE-2026-45684`, `GO-2026-5677` · Go `go.opentelemetry.io/obi`: affected `>=0.7.0, <0.9.0`, fixed in `0.9.0` · CVSS 4.9 Medium · Not analysed yet · Published 18 May 2026 · Tags: Memory corruption, CWE-126
- [PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array](https://agentprime.io/advisories/CVE-2026-6575.md)
  `CVE-2026-6575` · CVE record: PostgreSQL · CVSS 4.3 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-126
- [Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input](https://agentprime.io/advisories/CVE-2026-8463.md)
  `CVE-2026-8463` · CVE record: LEONT Crypt::Argon2 · CVSS 5.3 Medium · Not analysed yet · Published 13 May 2026 · Tags: Memory corruption, CWE-126
- [diesel-async may expose uninitialized padding bytes for MySQL temporal columns](https://agentprime.io/advisories/GHSA-ff9q-rm55-q7qr.md)
  `GHSA-ff9q-rm55-q7qr` · crates.io `diesel-async`: affected `>=0.1.0, <0.9.0`, fixed in `0.9.0` · CVSS 4.0, no score published · Not analysed yet · Published 7 May 2026 · Tags: CWE-126
- [Buffer Over-read in DSP Service](https://agentprime.io/advisories/CVE-2025-47406.md)
  `CVE-2025-47406` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 6.1 Medium · Not analysed yet · Published 4 May 2026 · Tags: CWE-126
- [Buffer Over-read in WLAN Firmware](https://agentprime.io/advisories/CVE-2025-47403.md)
  `CVE-2025-47403` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 6.5 Medium · Not analysed yet · Published 4 May 2026 · Tags: CWE-126
- [Buffer Over-read in WLAN HAL](https://agentprime.io/advisories/CVE-2025-47401.md)
  `CVE-2025-47401` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 6.5 Medium · Not analysed yet · Published 4 May 2026 · Tags: CWE-126
- [Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()](https://agentprime.io/advisories/CVE-2026-34059.md)
  `CVE-2026-34059` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-126
- [AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library.](https://agentprime.io/advisories/CVE-2026-37532.md)
  `CVE-2026-37532` · CVE record · CVSS 7.1 High · Not analysed yet · Published 1 May 2026 · Tags: CWE-126
- [Buffer Over-read in Wireshark](https://agentprime.io/advisories/CVE-2026-6532.md)
  `CVE-2026-6532` · CVE record: Wireshark Foundation Wireshark · CVSS 5.5 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: CWE-126
- [Buffer overread in ns_printrrf with corrupted RDATA field](https://agentprime.io/advisories/CVE-2026-6238.md)
  `CVE-2026-6238` · CVE record: The GNU C Library glibc · CVSS 6.5 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-126
- [rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer](https://agentprime.io/advisories/GHSA-hppc-g8h3-xhp3.md)
  `GHSA-hppc-g8h3-xhp3`, `CVE-2026-41898` · crates.io `openssl`: affected `>=0.9.24, <0.10.78`, fixed in `0.10.78` · CVSS 8.3 High · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-126, CWE-130
- [Potential wolfSSHd Buffer out-of-bounds Read on Windows Handling Terminal Resize](https://agentprime.io/advisories/CVE-2026-0930.md)
  `CVE-2026-0930` · CVE record: wolfSSL wolfSSH · CVSS 2.3 Low · Not analysed yet · Published 20 Apr 2026 · Tags: CWE-126
- [libgphoto2 has an OOB Read in ptp_unpack_EOS_FocusInfoEx](https://agentprime.io/advisories/CVE-2026-40341.md)
  `CVE-2026-40341` · CVE record: gphoto libgphoto2 · CVSS 3.5 Low · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-126
- [Windows Projected File System Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-26184.md)
  `CVE-2026-26184` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-126
- [Windows Kernel Memory Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-26169.md)
  `CVE-2026-26169` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-126
- [Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-26155.md)
  `CVE-2026-26155` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-126
- [MatchDomainName 1-Byte Stack Buffer Over-Read in Hostname Validation](https://agentprime.io/advisories/CVE-2026-5772.md)
  `CVE-2026-5772` · CVE record: wolfSSL wolfSSL · CVSS 2.1 Low · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-126
- [Buffer Over-read in WLAN Firmware](https://agentprime.io/advisories/CVE-2026-21381.md)
  `CVE-2026-21381` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.6 High · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-126
- [Buffer Over-read in Camera](https://agentprime.io/advisories/CVE-2026-21378.md)
  `CVE-2026-21378` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-126
- [Buffer Over-read in Camera](https://agentprime.io/advisories/CVE-2026-21376.md)
  `CVE-2026-21376` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-126
- [Buffer Over-read in Camera](https://agentprime.io/advisories/CVE-2026-21375.md)
  `CVE-2026-21375` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-126
- [Buffer Over-read in Camera](https://agentprime.io/advisories/CVE-2026-21374.md)
  `CVE-2026-21374` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-126
- [Buffer Over-read in Camera](https://agentprime.io/advisories/CVE-2026-21373.md)
  `CVE-2026-21373` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-126
- [Buffer Over-read in WinBlast Driver](https://agentprime.io/advisories/CVE-2026-21371.md)
  `CVE-2026-21371` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-126
- [Buffer Over-read in WLAN Firmware](https://agentprime.io/advisories/CVE-2026-21367.md)
  `CVE-2026-21367` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.6 High · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-126
- [Buffer Over-read in Computer Vision](https://agentprime.io/advisories/CVE-2025-47400.md)
  `CVE-2025-47400` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.1 High · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-126
- [Buffer Over-read in Camera](https://agentprime.io/advisories/CVE-2025-47390.md)
  `CVE-2025-47390` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-126
- [Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.](https://agentprime.io/advisories/CVE-2026-2394.md)
  `CVE-2026-2394` · CVE record: RTI Connext Professional · CVSS 6.3 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-126
- [Out-of-bounds read when parsing DNS packets via Lua](https://agentprime.io/advisories/CVE-2026-24028.md)
  `CVE-2026-24028` · CVE record: PowerDNS DNSdist · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-126
- [OpenSC: \`sc_compacttlv_find_tag\` can return out-of-bounds pointers](https://agentprime.io/advisories/CVE-2025-66038.md)
  `CVE-2025-66038` · CVE record: OpenSC OpenSC · CVSS 3.9 Low · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-126
- [Out of bounds read in IMAP parsing](https://agentprime.io/advisories/CVE-2026-4371.md)
  `CVE-2026-4371` · CVE record: Mozilla Thunderbird · CVSS 7.4 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-126, CWE-130
- [fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing](https://agentprime.io/advisories/GHSA-g3qj-j598-cxmq.md)
  `GHSA-g3qj-j598-cxmq` · npm `fido2-lib`: affected `<3.5.8`, fixed in `3.5.8` · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-126, CWE-1395
- [Buffer Over-read in Graphics](https://agentprime.io/advisories/CVE-2025-59600.md)
  `CVE-2025-59600` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-126
- [Out-of-bounds read in OCaml](https://agentprime.io/advisories/CVE-2026-28364.md)
  `CVE-2026-28364` · CVE record: OCaml OCaml · CVSS 7.9 High · Not analysed yet · Published 27 Feb 2026 · Tags: Memory corruption, CWE-126
- [Buffer Overread in FreeRDP Icon Processing](https://agentprime.io/advisories/CVE-2026-26271.md)
  `CVE-2026-26271` · CVE record: FreeRDP FreeRDP · CVSS 5.5 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-126
- [ImageMagick has a heap Buffer Over-read in its DJVU image format handler](https://agentprime.io/advisories/GHSA-r99p-5442-q2x2.md)
  `GHSA-r99p-5442-q2x2`, `CVE-2026-27799` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 4.0 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Memory corruption, CWE-126
- [ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images](https://agentprime.io/advisories/GHSA-qpgx-jfcq-r59f.md)
  `GHSA-qpgx-jfcq-r59f`, `CVE-2026-27798` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 4.0 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Memory corruption, CWE-126
- [Buffer Over-read in Wireshark](https://agentprime.io/advisories/CVE-2026-3203.md)
  `CVE-2026-3203` · CVE record: Wireshark Foundation Wireshark · CVSS 5.5 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-126
- [NanaZip has DotNet Single file OOB Heap Read](https://agentprime.io/advisories/CVE-2026-26282.md)
  `CVE-2026-26282` · CVE record: M2Team NanaZip · CVSS 5.2 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: CWE-126
- [GDI+ Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20846.md)
  `CVE-2026-20846` · CVE record: Microsoft Microsoft Office for Android and 4 more · CVSS 7.5 High · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-126
- [LIBPNG has a heap buffer overflow in png_set_quantize](https://agentprime.io/advisories/CVE-2026-25646.md)
  `CVE-2026-25646` · CVE record: pnggroup libpng · CVSS 8.3 High · Not analysed yet · Published 10 Feb 2026 · Tags: Memory corruption, CWE-126
- [Buffer Over-read in WLAN Firmware](https://agentprime.io/advisories/CVE-2025-47402.md)
  `CVE-2025-47402` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 6.5 Medium · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-126
- [A buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service (DoS) via a crafted input.](https://agentprime.io/advisories/CVE-2025-66692.md)
  `CVE-2025-66692` · CVE record · CVSS 7.5 High · Not analysed yet · Published 20 Jan 2026 · Tags: CWE-126

Newest: <https://agentprime.io/advisories/tag/cwe-126.md>
Older: <https://agentprime.io/advisories/tag/cwe-126.md?cursor=WyIyMDI2LTAxLTIwVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNS02NjY5MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-126&cursor=WyIyMDI2LTA3LTE0VDE1OjE5OjUxLjA4MDAwMFoiLCJDVkUtMjAyNS00Mzg5MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-126/?cursor=WyIyMDI2LTA3LTE0VDE1OjE5OjUxLjA4MDAwMFoiLCJDVkUtMjAyNS00Mzg5MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.