CWE-129.

FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data

• signalwire freeswitch
• Memory corruption
• CWE-129

VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length index

• VRPN
• CWE-129

ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders

• esa asn1scc
• Memory corruption
• CWE-129

ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)

• esa asn1scc
• Memory corruption
• CWE-129

Improper array index validation in Samsung Semiconductor Exynos 1280 and others

• Samsung Semiconductor Exynos 1280
• Samsung Semiconductor Exynos 1330
• CWE-129

Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets

• quozl netrek-client-cow
• CWE-129

Improper array index validation in NVIDIA Slurm

• NVIDIA Slurm
• CWE-129

psqlODBC does not validate column numbers and row indexes in binding and descriptor functions

• PostgreSQL psqlODBC
• Memory corruption
• CWE-129

Memory corruption vulnerability in QMqttClient impacts Qt MQTT

• Qt
• Memory corruption
• CWE-129

gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments

• gopacket
• Memory corruption
• CWE-129

MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication

• mariadb-corporation mariadb-connector-j
• Denial of service
• CWE-129

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

• CWE-129
• CWE-193

<0.32.0 · fixed in 0.32.0

Go JOSE: Panic during CBC-HMAC processing

• CWE-129

<=3.0.5 · no fixed version yet

Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service

• WatchGuard Fireware OS
• Memory corruption
• CWE-129

Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution

• WatchGuard Fireware OS
• Memory corruption
• CWE-129

snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite

• Memory corruption
• CWE-129

<1.1.10.9 · fixed in 1.1.10.9

llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer

• ggml-org llama.cpp
• CWE-129

llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs

• ggml-org llama.cpp
• CWE-129

Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import

• tildearrow furnace
• CWE-129

Multiple Out-of-Bounds Reads in Frame Processing

• RT-Labs AB SOEM
• Memory corruption
• CWE-129

Memory Corruption via FMMU Configuration Table Overflow

• RT-Labs AB SOEM
• Memory corruption
• CWE-129

vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids

• vllm
• CWE-129

RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header

• diegonehab rply
• CWE-129

JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation

• Eclipse Foundation Eclipse KeyPont - GOSE
• CWE-129

Denial of Service via Malformed VATP Packet in Velneo vServer

• Velneo vServer
• CWE-129

HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index

• HMS Networks PEAK-System Device Driver Setup
• HMS Networks PCAN Windows CAN device drivers
• CWE-129

Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena

• Eclipse Foundation Eclipse ThreadX - GUIX
• Memory corruption
• CWE-129

libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS

• mz-automation libiec61850
• Memory corruption
• CWE-129

SFTPGo: Denial of service via malformed SSH channel request

• CWE-129

<2.7.5 · fixed in 2.7.5

Improper array index validation in Samsung Open Source Vyond

• Samsung Open Source Vyond
• CWE-129

F´: Unvalidated Port Index in GenericHub

• nasa fprime
• CWE-129

Out-of-bounds zero-length stream writes can panic

• CWE-129

>=46.0.0, <48.0.6 || >=49.0.0, <49.0.3 · fixed in 48.0.6, 49.0.3

FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry

• FreeRDP
• CWE-129

FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys()

• FreeRDP
• CWE-129

Improper array index validation in canva affinity

• canva affinity
• CWE-129

SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup

• sumatrapdf
• CWE-129

Application denial of service via missing BSON array length validation in MongoDB Go Driver

• MongoDB Go Driver
• CWE-129

Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

• CWE-129

>=2.8.1, <2.11.1-0.20261003002531-6258dcebc4e2 · fixed in 2.11.1-0.20261003002531-6258dcebc4e2

Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows

• Memory corruption
• CWE-129

>=1.1.0, <=1.4.1 · no fixed version yet

Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics

• CWE-129

>=2.10.1, <2.11.1-0.20260908032718-ecd99d761fe0 · fixed in 2.11.1-0.20260908032718-ecd99d761fe0

Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

• Memory corruption
• CWE-129

>=2.7.1, <2.11.1-0.20260820023833-99903a3240e5 · fixed in 2.11.1-0.20260820023833-99903a3240e5

Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check

• Memory corruption
• CWE-129

>=2.7.0, <2.11.1-0.20260812075026-be7a16390fa6 · fixed in 2.11.1-0.20260812075026-be7a16390fa6

Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml

• CWE-20
• CWE-129

>=2.8.0, <2.11.1-0.20260731010303-ae2113b410e5 · fixed in 2.11.1-0.20260731010303-ae2113b410e5

Vyper: Memory corruption using function calls within tuples / nested calls

• Memory corruption
• CWE-129

<0.2.6 · fixed in 0.2.6

Malformed LLB file operation can crash buildkitd

• moby BuildKit
• CWE-129

Malformed MergeOp can crash the BuildKit daemon

• moby BuildKit
• CWE-129

Improper array index validation in MediaTek, Inc. MediaTek chipset

• MediaTek, Inc. MediaTek chipset
• CWE-129

russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic

• CWE-129

<0.63.1 · fixed in 0.63.1

Improper array index validation in NVIDIA GeForce and others

• NVIDIA GeForce
• NVIDIA RTX, Quadro, NVS
• CWE-129

Improper array index validation in NVIDIA GeForce and others

• NVIDIA GeForce
• NVIDIA RTX, Quadro, NVS
• CWE-129

Improper array index validation in NVIDIA GeForce and others

• NVIDIA GeForce
• NVIDIA RTX, Quadro, NVS
• CWE-129

Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them

• Apache Software Foundation Apache PLC4X
• Denial of service
• CWE-129

Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths

• Apache Software Foundation Apache PLC4X
• Memory corruption
• Denial of service

vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

• vllm
• CWE-129

This Power System update is being released to address

• IBM PowerVM Hypervisor
• CWE-129

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

• square wire
• CWE-129

alsa-lib through 1.2.16.1 Denial of Service via pcm_multi

• ALSA Project alsa-lib
• CWE-129

Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

• CWE-129

>=3.0.0, <3.11.2 · fixed in 3.11.2

temporalio/tchannel-go zero-chunk call fragment causes process termination

• Temporal Technologies, Inc. temporalio/tchannel-go
• CWE-129

temporalio/tchannel-go malformed checksum type causes process termination

• Temporal Technologies, Inc. temporalio/tchannel-go
• CWE-129