# CWE-129.

Every Advisory and CVE whose sources give the weakness CWE-129, newest first.

## Records, newest first

- [FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data](https://agentprime.io/advisories/CVE-2026-116783.md)
  `CVE-2026-116783` · CVE record: signalwire freeswitch · CVSS 8.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, CWE-129
- [VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length index](https://agentprime.io/advisories/CVE-2026-123200.md)
  `CVE-2026-123200` · CVE record: VRPN VRPN · CVSS 8.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-129
- [ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders](https://agentprime.io/advisories/CVE-2026-75615.md)
  `CVE-2026-75615` · CVE record: esa asn1scc · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, CWE-129
- [ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)](https://agentprime.io/advisories/CVE-2026-75614.md)
  `CVE-2026-75614` · CVE record: esa asn1scc · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, CWE-129
- [Improper array index validation in Samsung Semiconductor Exynos 1280 and others](https://agentprime.io/advisories/CVE-2025-66366.md)
  `CVE-2025-66366` · CVE record: Samsung Semiconductor Exynos 1280 and 4 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-129
- [Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets](https://agentprime.io/advisories/CVE-2026-121968.md)
  `CVE-2026-121968` · CVE record: quozl netrek-client-cow · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-129
- [Improper array index validation in NVIDIA Slurm](https://agentprime.io/advisories/CVE-2026-65165.md)
  `CVE-2026-65165` · CVE record: NVIDIA Slurm · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-129
- [psqlODBC does not validate column numbers and row indexes in binding and descriptor functions](https://agentprime.io/advisories/CVE-2026-120064.md)
  `CVE-2026-120064` · CVE record: PostgreSQL psqlODBC · CVSS 7.5 High · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption, CWE-129
- [Memory corruption vulnerability in QMqttClient impacts Qt MQTT](https://agentprime.io/advisories/CVE-2026-107457.md)
  `CVE-2026-107457` · CVE record: qt Qt · CVSS 2.3 Low · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption, CWE-129
- [gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments](https://agentprime.io/advisories/CVE-2026-119299.md)
  `CVE-2026-119299` · CVE record: gopacket gopacket · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption, CWE-129
- [MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication](https://agentprime.io/advisories/CVE-2026-119278.md)
  `CVE-2026-119278` · CVE record: mariadb-corporation mariadb-connector-j · CVSS 5.9 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service, CWE-129
- [vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)](https://agentprime.io/advisories/GHSA-q97c-p368-75c4.md)
  `GHSA-q97c-p368-75c4`, `CVE-2026-115916`, `PYSEC-2026-4347` · PyPI `vllm`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-129, CWE-193
- [Go JOSE: Panic during CBC-HMAC processing](https://agentprime.io/advisories/GHSA-4w3g-jfj2-cw2q.md)
  `GHSA-4w3g-jfj2-cw2q`, `CVE-2026-116585` · Go `github.com/go-jose/go-jose/v3` and 1 more: affected `<=3.0.5`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-129
- [Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service](https://agentprime.io/advisories/CVE-2026-93862.md)
  `CVE-2026-93862` · CVE record: WatchGuard Fireware OS · CVSS 7.2 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption, CWE-129, CWE-823
- [Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution](https://agentprime.io/advisories/CVE-2026-113881.md)
  `CVE-2026-113881` · CVE record: WatchGuard Fireware OS · CVSS 6.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption, CWE-129
- [snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite](https://agentprime.io/advisories/GHSA-xqrx-qh46-34m7.md)
  `GHSA-xqrx-qh46-34m7`, `CVE-2026-116590` · Maven `org.xerial.snappy:snappy-java`: affected `<1.1.10.9`, fixed in `1.1.10.9` · CVSS 5.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption, CWE-129
- [llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer](https://agentprime.io/advisories/CVE-2026-116816.md)
  `CVE-2026-116816` · CVE record: ggml-org llama.cpp · CVSS 8.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-129
- [llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs](https://agentprime.io/advisories/CVE-2024-58400.md)
  `CVE-2024-58400` · CVE record: ggml-org llama.cpp · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-129
- [Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import](https://agentprime.io/advisories/CVE-2026-116731.md)
  `CVE-2026-116731` · CVE record: tildearrow furnace · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-129
- [Multiple Out-of-Bounds Reads in Frame Processing](https://agentprime.io/advisories/CVE-2026-82947.md)
  `CVE-2026-82947` · CVE record: RT-Labs AB SOEM · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption, CWE-129
- [Memory Corruption via FMMU Configuration Table Overflow](https://agentprime.io/advisories/CVE-2026-82945.md)
  `CVE-2026-82945` · CVE record: RT-Labs AB SOEM · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption, CWE-129
- [vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids](https://agentprime.io/advisories/CVE-2026-116181.md)
  `CVE-2026-116181` · CVE record: vllm-project vllm · CVSS 7.1 High · Not analysed yet · Published 25 Oct 2026 · Tags: CWE-129
- [RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header](https://agentprime.io/advisories/CVE-2026-115722.md)
  `CVE-2026-115722` · CVE record: diegonehab rply · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-129
- [JweDirectDecryptorBlock.Decrypt: unchecked \_thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation](https://agentprime.io/advisories/CVE-2026-89319.md)
  `CVE-2026-89319` · CVE record: Eclipse Foundation Eclipse KeyPont - GOSE · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-129
- [Denial of Service via Malformed VATP Packet in Velneo vServer](https://agentprime.io/advisories/CVE-2026-114405.md)
  `CVE-2026-114405` · CVE record: Velneo vServer · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-129
- [HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index](https://agentprime.io/advisories/CVE-2026-103672.md)
  `CVE-2026-103672` · CVE record: HMS Networks PEAK-System Device Driver Setup and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-129
- [Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena](https://agentprime.io/advisories/CVE-2026-92449.md)
  `CVE-2026-92449` · CVE record: Eclipse Foundation Eclipse ThreadX - GUIX · CVSS 6.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption, CWE-129
- [libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS](https://agentprime.io/advisories/CVE-2026-48741.md)
  `CVE-2026-48741` · CVE record: mz-automation libiec61850 · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption, CWE-129, CWE-252, CWE-754
- [SFTPGo: Denial of service via malformed SSH channel request](https://agentprime.io/advisories/GHSA-q7pc-356p-hggc.md)
  `GHSA-q7pc-356p-hggc`, `CVE-2026-77375`, `GO-2026-6792` · Go `github.com/drakkan/sftpgo/v2`: affected `<2.7.5`, fixed in `2.7.5` · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-129
- [Improper array index validation in Samsung Open Source Vyond](https://agentprime.io/advisories/CVE-2026-110934.md)
  `CVE-2026-110934` · CVE record: Samsung Open Source Vyond · CVSS 4.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-129
- [F´: Unvalidated Port Index in GenericHub](https://agentprime.io/advisories/CVE-2026-92152.md)
  `CVE-2026-92152` · CVE record: nasa fprime · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-129
- [Out-of-bounds zero-length stream writes can panic](https://agentprime.io/advisories/GHSA-93g3-36p8-x2gc.md)
  `GHSA-93g3-36p8-x2gc`, `CVE-2026-119143`, `RUSTSEC-2026-0357` · crates.io `wasmtime`: affected `>=46.0.0, <48.0.6 || >=49.0.0, <49.0.3`, fixed in `48.0.6`, `49.0.3` · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-129
- [FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry](https://agentprime.io/advisories/CVE-2026-109251.md)
  `CVE-2026-109251` · CVE record: FreeRDP FreeRDP · CVSS 6.0 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-129
- [FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys()](https://agentprime.io/advisories/CVE-2026-109250.md)
  `CVE-2026-109250` · CVE record: FreeRDP FreeRDP · CVSS 7.0 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-129
- [Improper array index validation in canva affinity](https://agentprime.io/advisories/CVE-2026-103220.md)
  `CVE-2026-103220` · CVE record: canva affinity · CVSS 4.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-129
- [SumatraPDF CHM \`its://\` signed index causes an out-of-bounds object lookup](https://agentprime.io/advisories/CVE-2026-107737.md)
  `CVE-2026-107737` · CVE record: sumatrapdfreader sumatrapdf · CVSS 5.7 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-129
- [Application denial of service via missing BSON array length validation in MongoDB Go Driver](https://agentprime.io/advisories/CVE-2026-107325.md)
  `CVE-2026-107325` · CVE record: MongoDB Go Driver · CVSS 8.2 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-129
- [Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic](https://agentprime.io/advisories/GHSA-mx22-3794-2vpv.md)
  `GHSA-mx22-3794-2vpv`, `CVE-2026-107211`, `GO-2026-6695` · Go `github.com/xuri/excelize/v2`: affected `>=2.8.1, <2.11.1-0.20261003002531-6258dcebc4e2`, fixed in `2.11.1-0.20261003002531-6258dcebc4e2` · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-129
- [Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows](https://agentprime.io/advisories/GHSA-c85p-xxjj-2r75.md)
  `GHSA-c85p-xxjj-2r75`, `CVE-2026-107217`, `GO-2026-6677` · Go `github.com/xuri/excelize` and 1 more: affected `>=1.1.0, <=1.4.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption, CWE-129
- [Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics](https://agentprime.io/advisories/GHSA-8jjq-8j9w-m2v6.md)
  `GHSA-8jjq-8j9w-m2v6`, `CVE-2026-107218`, `GO-2026-6675` · Go `github.com/xuri/excelize/v2`: affected `>=2.10.1, <2.11.1-0.20260908032718-ecd99d761fe0`, fixed in `2.11.1-0.20260908032718-ecd99d761fe0` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-129
- [Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref](https://agentprime.io/advisories/GHSA-g27h-8qhm-6pff.md)
  `GHSA-g27h-8qhm-6pff`, `CVE-2026-107220`, `GO-2026-6680` · Go `github.com/xuri/excelize/v2`: affected `>=2.7.1, <2.11.1-0.20260820023833-99903a3240e5`, fixed in `2.11.1-0.20260820023833-99903a3240e5` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption, CWE-129
- [Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check](https://agentprime.io/advisories/GHSA-rxcj-4pj5-74gr.md)
  `GHSA-rxcj-4pj5-74gr`, `CVE-2026-107222`, `GO-2026-6682` · Go `github.com/xuri/excelize/v2`: affected `>=2.7.0, <2.11.1-0.20260812075026-be7a16390fa6`, fixed in `2.11.1-0.20260812075026-be7a16390fa6` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption, CWE-129
- [Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml](https://agentprime.io/advisories/GHSA-5h23-36rv-pm65.md)
  `GHSA-5h23-36rv-pm65`, `CVE-2026-107225`, `GO-2026-6674` · Go `github.com/xuri/excelize/v2`: affected `>=2.8.0, <2.11.1-0.20260731010303-ae2113b410e5`, fixed in `2.11.1-0.20260731010303-ae2113b410e5` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-20, CWE-129
- [Vyper: Memory corruption using function calls within tuples / nested calls](https://agentprime.io/advisories/GHSA-2r3x-4mrv-mcxf.md)
  `GHSA-2r3x-4mrv-mcxf`, `CVE-2020-37286` · PyPI `vyper`: affected `<0.2.6`, fixed in `0.2.6` · CVSS 8.3 High · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption, CWE-129
- [Malformed LLB file operation can crash buildkitd](https://agentprime.io/advisories/CVE-2026-93321.md)
  `CVE-2026-93321` · CVE record: moby BuildKit · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-129
- [Malformed MergeOp can crash the BuildKit daemon](https://agentprime.io/advisories/CVE-2026-93322.md)
  `CVE-2026-93322` · CVE record: moby BuildKit · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-129
- [Improper array index validation in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-20527.md)
  `CVE-2026-20527` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-129
- [russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic](https://agentprime.io/advisories/GHSA-p8qx-h547-fjw9.md)
  `GHSA-p8qx-h547-fjw9`, `CVE-2026-102822` · crates.io `russh`: affected `<0.63.1`, fixed in `0.63.1` · CVSS 3.7 Low · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-129
- [Improper array index validation in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47533.md)
  `CVE-2026-47533` · CVE record: NVIDIA GeForce and 2 more · CVSS 6.7 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-129
- [Improper array index validation in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47525.md)
  `CVE-2026-47525` · CVE record: NVIDIA GeForce and 2 more · CVSS 6.7 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-129
- [Improper array index validation in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47507.md)
  `CVE-2026-47507` · CVE record: NVIDIA GeForce and 3 more · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-129
- [Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them](https://agentprime.io/advisories/CVE-2026-102511.md)
  `CVE-2026-102511` · CVE record: Apache Software Foundation Apache PLC4X · CVSS 8.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Denial of service, CWE-129, CWE-248, CWE-940
- [Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths](https://agentprime.io/advisories/CVE-2026-102510.md)
  `CVE-2026-102510` · CVE record: Apache Software Foundation Apache PLC4X · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Memory corruption, Denial of service, CWE-129
- [vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids](https://agentprime.io/advisories/CVE-2026-100654.md)
  `CVE-2026-100654` · CVE record: vllm-project vllm · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-129
- [This Power System update is being released to address](https://agentprime.io/advisories/CVE-2026-17413.md)
  `CVE-2026-17413` · CVE record: IBM PowerVM Hypervisor · CVSS 5.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-129
- [Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service](https://agentprime.io/advisories/CVE-2026-61695.md)
  `CVE-2026-61695` · CVE record: square wire · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-129
- [alsa-lib through 1.2.16.1 Denial of Service via pcm_multi](https://agentprime.io/advisories/CVE-2026-96675.md)
  `CVE-2026-96675` · CVE record: ALSA Project alsa-lib · CVSS 4.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-129
- [Dasel: Selector lexer panics on trailing whitespace in \`parseCurRune\`](https://agentprime.io/advisories/GHSA-65gg-g7rw-6cpc.md)
  `GHSA-65gg-g7rw-6cpc`, `CVE-2026-62866`, `GO-2026-6548` · Go `github.com/tomwright/dasel/v3`: affected `>=3.0.0, <3.11.2`, fixed in `3.11.2` · CVSS 6.2 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-129
- [temporalio/tchannel-go zero-chunk call fragment causes process termination](https://agentprime.io/advisories/CVE-2026-65653.md)
  `CVE-2026-65653` · CVE record: Temporal Technologies, Inc. temporalio/tchannel-go · CVSS 8.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-129
- [temporalio/tchannel-go malformed checksum type causes process termination](https://agentprime.io/advisories/CVE-2026-65652.md)
  `CVE-2026-65652` · CVE record: Temporal Technologies, Inc. temporalio/tchannel-go · CVSS 8.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-129

Older: <https://agentprime.io/advisories/tag/cwe-129.md?cursor=WyIyMDI2LTA5LTIxVDExOjM1OjQwLjg5NjAwMFoiLCJDVkUtMjAyNi02NTY1MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-129>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-129/>. Everything for agents: <https://agentprime.io/llms.txt>.