CWE-129.

temporalio/sqlparser malformed MySQL version comments can cause a panic

• Temporal Technologies, Inc. temporalio/sqlparser
• Temporal Technologies, Inc. Temporal Server
• CWE-129

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds toke...

• CWE-129

<0.30.0 · fixed in 0.30.0

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabul...

• CWE-129

<0.30.0 · fixed in 0.30.0

vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). Attackers can supply token IDs above th...

• CWE-129

<0.29.0 · fixed in 0.29.0

OpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS

• AcademySoftwareFoundation OpenImageIO
• Memory corruption
• CWE-129

OpenImageIO: PSD RawColor indexed image out-of-bounds read in `interleave_row`

• AcademySoftwareFoundation OpenImageIO
• Memory corruption
• CWE-129

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative...

• CWE-129

<0.28.0 · fixed in 0.28.0

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

• HP Inc. HP Linux Imaging and Printing Software (HPLIP)
• CWE-129

Server panic via missing authority or Host headers in google.golang.org/grpc

• CWE-129
• CWE-248

<1.82.2 || >=1.83.0, <1.83.2 || >=1.84.0-dev, <1.84.0-dev.0.20260825144003-d5a41119e0e3 || >=1.85.0-dev, <1.85.0-dev.0.20260825072537-93e31b48545e · fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e

Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization

• tesseract
• Memory corruption
• CWE-129

Improper array index validation in Google Chrome

• Google Chrome
• CWE-129

OOBR and OOBW in libpcap before 1.10.7

• The Tcpdump Group libpcap
• Memory corruption
• CWE-129

PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance

• pjsip pjproject
• Memory corruption
• CWE-129

Out-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds check

• Samsung Open Source TizenFX
• Memory corruption
• CWE-129

Improper array index validation in AMD Radeon™ PRO V620 Graphics Products

• AMD Radeon™ PRO V620 Graphics Products
• CWE-129

Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-129

Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution

• WatchGuard Fireware OS
• Memory corruption
• CWE-129

rclone Archive Backend SquashFS Parser Denial of Service

• rclone
• CWE-129

Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id

• zephyr
• CWE-129

Power System Improper Validation

• IBM PowerVM Hypervisor
• CWE-129

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• CWE-129

resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

• Memory corruption
• CWE-129

<6.2.9 · fixed in 6.2.9

Deskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexing

• deskflow
• Memory corruption
• CWE-129

Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes

• capstone
• Memory corruption
• CWE-129

rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block

• rsync
• Memory corruption
• CWE-129

TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Bulk Dictionary Decompression Negative Index

• timescaledb
• Memory corruption
• CWE-129

TimescaleDB 2.29.1 Out-of-Bounds Read Information Disclosure via Dictionary Compression Reverse Iterator

• timescaledb
• Memory corruption
• CWE-129

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

• Denial of service
• CWE-20

<1.13.0 · fixed in 1.13.0

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

• Memory corruption
• CWE-129

>=0.53.0, <0.70.1 · fixed in 0.70.1

Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

• CWE-129

<0.62.4 · fixed in 0.62.4

Helm Files.Lines Denial of Service via Empty Chart Files

• helm
• CWE-129

ncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter id

• Tencent ncnn
• Memory corruption
• CWE-20

Improper array index validation in NVIDIA TensorRT

• NVIDIA TensorRT
• CWE-129

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations ...

• CWE-129

· no fixed version yet

GoBGP confederation validation panics on empty AS_PATH attribute

• CWE-129

<4.7.0 · fixed in 4.7.0

Foxit PDF Editor/Reader Cloud Appearance Buffer Overflow Vulnerability

• Foxit Software Inc. Foxit PDF Editor
• Foxit Software Inc. Foxit PDF Reader
• CWE-129

GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability

• GeoVision Inc. GeoWebPlayer
• CWE-129

GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability

• GeoVision Inc. GeoWebPlayer
• CWE-129

GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability

• GeoVision Inc. GeoWebPlayer
• CWE-129

GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability

• GeoVision Inc. GeoWebPlayer
• CWE-129

GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability

• GeoVision Inc. GeoWebPlayer
• CWE-129

GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability

• GeoVision Inc. GeoWebPlayer
• CWE-129

GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability

• GeoVision Inc. GeoWebPlayer
• CWE-129

GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability

• GeoVision Inc. GeoWebPlayer
• CWE-129

GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability

• GeoVision Inc. GeoWebPlayer
• CWE-129

GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability

• GeoVision Inc. GeoWebPlayer
• CWE-129

GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability

• GeoVision Inc. GeoWebPlayer
• CWE-129

Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts

• CWE-129

<1.21.0 · fixed in 1.21.0

DVP80ES300T - Improper Validation of Array Index Vulnerability

• deltaww DVP80ES300T
• CWE-129

WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader

• RARLAB WinRAR
• RAR
• Memory corruption
• CWE-129

Improper array index validation in vtk

• vtk
• CWE-129

libais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message ID

• schwehr libais
• CWE-129

Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler

• Marlin
• CWE-129

NGINX Gateway Fabric vulnerability

• F5 NGINX Gateway Fabric
• CWE-129

Improper array index validation in NVIDIA DALI

• NVIDIA DALI
• CWE-129

Improper Validation of Array Index in Secure Processor

• Qualcomm, Inc. Snapdragon
• CWE-129

MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`

• MapServer
• Memory corruption
• CWE-129

Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

• CWE-129

<0.52.0 · fixed in 0.52.0

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

• CWE-129

>=3.0.0, <=3.10.0 · no fixed version yet

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

• CWE-129

<6.3.0 || >=7.0.0-alpha01, <7.0.0-alpha03 · fixed in 6.3.0, 7.0.0-alpha03