Advisories · Weakness

CWE-126.

Every Advisory and CVE whose sources give the weakness CWE-126, newest first.

CVE-2026-93524 CVE record

CVSS 6.9 Medium

X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
- x.org xorg-x11-server
- x.org xwayland
- CWE-126
Not analysed yet 28 Oct 2026
CVE-2026-57185 CVE record

CVSS 6.5 Medium

Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
- asterisk
- certified-asterisk
- CWE-126
- CWE-170
Not analysed yet 27 Oct 2026
CVE-2026-55606 CVE record

CVSS 6.5 Medium

odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
- openwrt odhcpd
- CWE-126
Not analysed yet 23 Oct 2026
CVE-2026-53920 CVE record

CVSS 8.7 High

odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
- openwrt odhcpd
- Memory corruption
- Information disclosure
Not analysed yet 23 Oct 2026
pillow PyPI

CVSS 6.3 Medium

Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
- CWE-126
<13.0.0 · fixed in 13.0.0

GHSA-4558-3h8r-v8xp · CVE-2026-112394 Not analysed yet 21 Oct 2026
pillow PyPI

CVSS 8.8 High

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
- Memory corruption
- CWE-126
>=8.1.0, <13.0.0 · fixed in 13.0.0

GHSA-c6hw-5grf-ff96 · CVE-2026-112404 Not analysed yet 20 Oct 2026
CVE-2026-107928 CVE record

CVSS 8.1 High

info leak uploading over WebSockets with GnuTLS
- curl
- CWE-126
Not analysed yet 20 Oct 2026
CVE-2026-85745 CVE record

CVSS 4.3 Medium

MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.
- MariaDB server
- CWE-126
Not analysed yet 16 Oct 2026
CVE-2026-46471 CVE record

CVSS 5.5 Medium

An issue was discovered in GStreamer gst-plugins-good before 1.28.2.
- CWE-126
Not analysed yet 16 Oct 2026
CVE-2026-108454 CVE record

CVSS 6.5 Medium

Microsoft Office PowerPoint Information Disclosure Vulnerability
- Microsoft 365 Apps for Enterprise
- Microsoft Office 365 for Mac
- CWE-126
Not analysed yet 15 Oct 2026
CVE-2026-101310 CVE record

CVSS 7.0 High

Multiple vulnerabilities in bhyve device models
- FreeBSD
- Race condition
- Memory corruption
Not analysed yet 15 Oct 2026
CVE-2026-97828 CVE record

CVSS 6.5 Medium

Role: DNS Server Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-103567 CVE record

CVSS 5.5 Medium

Windows Broadcast DVR User Service Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1809
- Microsoft Windows 10 Version 21H2
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-88195 CVE record

CVSS 6.5 Medium

Microsoft Office Excel Information Disclosure Vulnerability
- Microsoft 365 Apps for Enterprise
- Microsoft Office LTSC 2021
- Memory corruption
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-69884 CVE record

CVSS 7.8 High

Windows GDI Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-85910 CVE record

CVSS 5.5 Medium

Windows StateRepository API Information Disclosure Vulnerability
- Microsoft Windows 11 Version 24H2
- Microsoft Windows 11 Version 25H2
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-83835 CVE record

CVSS 5.5 Medium

Windows Common Log File System Driver Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Information disclosure
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-83788 CVE record

CVSS 4.6 Medium

Windows rndismp6.sys Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-83685 CVE record

CVSS 6.5 Medium

Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-83565 CVE record

CVSS 5.5 Medium

Windows Encrypting File System (EFS) Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-95904 CVE record

CVSS 5.5 Medium

Windows Event Logging Service Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-96851 CVE record

CVSS 5.5 Medium

Windows Management Instrumentation Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-96848 CVE record

CVSS 5.5 Medium

Windows Win32 Kernel Subsystem Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1809
- Microsoft Windows 10 Version 21H2
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-88201 CVE record

CVSS 6.5 Medium

Microsoft Office Excel Information Disclosure Vulnerability
- Microsoft 365 Apps for Enterprise
- Microsoft Office LTSC 2021
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-88167 CVE record

CVSS 6.5 Medium

Microsoft Office Word Information Disclosure Vulnerability
- Microsoft 365 Apps for Enterprise
- Microsoft Office 365 for Mac
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-85935 CVE record

CVSS 5.5 Medium

Windows USB Driver Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-83888 CVE record

CVSS 6.5 Medium

Windows CD-ROM Driver Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-70041 CVE record

CVSS 5.5 Medium

Windows CD-ROM Driver Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-85835 CVE record

CVSS 5.5 Medium

Servicing Stack Updates Information Disclosure Vulnerability
- Microsoft Windows 11 Version 24H2
- Microsoft Windows 11 Version 25H2
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-83727 CVE record

CVSS 7.8 High

Windows Overlay Filter Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-83719 CVE record

CVSS 5.5 Medium

Servicing Stack Updates Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1809
- Microsoft Windows 10 Version 21H2
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-70234 CVE record

CVSS 5.5 Medium

Desktop Window Manager Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-69957 CVE record

CVSS 7.8 High

Windows Overlay Filter Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Memory corruption
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-69954 CVE record

CVSS 5.5 Medium

Windows Overlay Filter Information Disclosure Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-69953 CVE record

CVSS 7.8 High

Windows Overlay Filter Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-69950 CVE record

CVSS 7.8 High

Windows Overlay Filter Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-69942 CVE record

CVSS 7.8 High

Windows Overlay Filter Remote Code Execution Vulnerability
- Microsoft Windows 11 version 23H2
- Microsoft Windows 11 Version 24H2
- CWE-126
Not analysed yet 13 Oct 2026
CVE-2026-101130 CVE record

CVSS 3.6 Low

canva affinity: The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform…
- canva affinity
- CWE-126
Not analysed yet 9 Oct 2026
CVE-2026-101094 CVE record

CVSS 3.6 Low

canva affinity: The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly…
- canva affinity
- CWE-126
Not analysed yet 9 Oct 2026
CVE-2026-96394 CVE record

CVSS 2.9 Low

canva affinity: The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not…
- canva affinity
- CWE-126
Not analysed yet 9 Oct 2026
CVE-2026-57546 CVE record

CVSS 7.5 High

Buffer Over-read in WLAN HAL
- Qualcomm, Inc. Snapdragon
- CWE-126
Not analysed yet 6 Oct 2026
CVE-2026-20541 CVE record

CVSS 5.3 Medium

In Modem, there is a possible out of bounds read due to a missing permission check.
- MediaTek, Inc. MediaTek chipset
- CWE-126
Not analysed yet 5 Oct 2026
CVE-2026-20540 CVE record

CVSS 5.3 Medium

In Modem, there is a possible out of bounds read due to a missing bounds check.
- MediaTek, Inc. MediaTek chipset
- CWE-126
Not analysed yet 5 Oct 2026
CVE-2026-20539 CVE record

CVSS 5.3 Medium

In Modem, there is a possible out of bounds read due to a missing bounds check.
- MediaTek, Inc. MediaTek chipset
- CWE-126
Not analysed yet 5 Oct 2026
CVE-2026-20538 CVE record

CVSS 5.3 Medium

In Modem, there is a possible out of bounds read due to a missing permission check.
- MediaTek, Inc. MediaTek chipset
- CWE-126
Not analysed yet 5 Oct 2026
CVE-2026-102728 CVE record

CVSS 6.3 Medium

Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)
- Eclipse Foundation Eclipse ThreadX NetX Duo
- CWE-126
Not analysed yet 29 Sept 2026
CVE-2026-102758 CVE record

CVSS 7.5 High

The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data.
- Eclipse Foundation NetX Duo
- CWE-126
Not analysed yet 29 Sept 2026
CVE-2026-95392 CVE record

CVSS 5.5 Medium

Buffer Over-read in Wireshark
- Wireshark
- CWE-126
Not analysed yet 29 Sept 2026
CVE-2026-96420 CVE record

CVSS 4.7 Medium

Buffer Over-read in Wireshark
- Wireshark
- CWE-126
Not analysed yet 29 Sept 2026
CVE-2026-97399 CVE record

CVSS 3.7 Low

One-byte overread in strncasecmp on Power8
- The GNU C Library glibc
- CWE-126
Not analysed yet 28 Sept 2026
CVE-2026-94286 CVE record

CVSS 7.1 High

Out-of-bounds read in libXtst's RECORD reply parser
- x.org libXtst
- CWE-126
Not analysed yet 28 Sept 2026
CVE-2026-86243 CVE record

CVSS 7.5 High

Apache Tomcat Native: DoS via TLS handshake
- Apache Software Foundation Apache Tomcat Native
- CWE-126
Not analysed yet 23 Sept 2026
CVE-2026-25294 CVE record

CVSS 7.4 High

Buffer Over-read in WLAN Firmware
- Qualcomm, Inc. Snapdragon
- CWE-126
Not analysed yet 17 Sept 2026
CVE-2026-25284 CVE record

CVSS 7.3 High

Buffer Over-read in OOBM
- Qualcomm, Inc. Snapdragon
- CWE-126
Not analysed yet 17 Sept 2026
CVE-2026-25275 CVE record

CVSS 7.5 High

Buffer Over-read in WLAN Firmware
- Qualcomm, Inc. Snapdragon
- CWE-126
Not analysed yet 17 Sept 2026
CVE-2026-24081 CVE record

CVSS 7.4 High

Buffer Over-read in BT Controller
- Qualcomm, Inc. Snapdragon
- CWE-126
Not analysed yet 17 Sept 2026
CVE-2026-24075 CVE record

CVSS 7.8 High

Buffer Over-read in Qualcomm IPC
- Qualcomm, Inc. Snapdragon
- CWE-126
Not analysed yet 17 Sept 2026
CVE-2026-90610 CVE record

CVSS 4.8 Medium

GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-read
- GPAC
- Memory corruption
- CWE-126
Not analysed yet 14 Sept 2026
CVE-2026-76653 CVE record

CVSS 5.3 Medium

Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600
- TP-Link Systems Inc. TL-MR6400 v8
- TP-Link Systems Inc. Archer MR600
- CWE-126
Not analysed yet 10 Sept 2026
CVE-2026-83949 CVE record

CVSS 5.5 Medium

Microsoft Office Word Information Disclosure Vulnerability
- Microsoft 365 Apps for Enterprise
- Microsoft Office 2019
- CWE-126
Not analysed yet 8 Sept 2026