CWE-193.

FreeSWITCH: Pre-authentication out-of-bounds writes in mod_xml_rpc WebSocket frame parsing

• signalwire freeswitch
• Memory corruption
• CWE-193

FreeSWITCH: Off-by-one heap write in core XML serialization of four-byte UTF-8 sequences

• signalwire freeswitch
• Memory corruption
• CWE-193

psqlODBC ODBC escape parser stack buffer overflow

• PostgreSQL psqlODBC
• Memory corruption
• CWE-193

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

• CWE-129
• CWE-193

<0.32.0 · fixed in 0.32.0

snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods

• Memory corruption
• CWE-193

<1.1.10.9 · fixed in 1.1.10.9

libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries

• libyal libpff
• CWE-193

Mod_qos: query truncation during json body merging permits security-rule bypass

• pbuchbinder mod_qos
• CWE-193

IBM MQ Buffer Overflow

• IBM MQ Operator
• IBM MQ Advanced container images
• CWE-193

unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name

• selmf unarr
• CWE-193

Microsoft Office Word Remote Code Execution Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 365 for Mac
• CWE-193

Remote DoS via receive-side kernel TLS

• FreeBSD
• Memory corruption
• CWE-193

Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()

• Michael R Sweet Mini-XML
• CWE-193

Microsoft Office Excel Remote Code Execution Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 365 for Mac
• Memory corruption
• CWE-193

Microsoft Office Visio Remote Code Execution Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office LTSC 2021
• Memory corruption
• CWE-193

Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

• CWE-172
• CWE-193

>=3.0.0, <3.8.0 · fixed in 3.8.0

wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms

• wolfSSL Inc. wolfSSH
• Memory corruption
• CWE-193

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a m…

• Memory corruption
• CWE-193

Off-by-one error in OpenBSD OpenSSH

• OpenBSD OpenSSH
• CWE-193

Sssd: sssd: access control bypass via improper ldap shadow expiration check

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-193

DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer

• Eclipse Foundation Eclipse ThreadX NetX Duo
• Memory corruption
• CWE-193

Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one

• Trusted Domain Project OpenDMARC
• CWE-189
• CWE-193

Trusted Domain Project OpenDKIM Decoder util.c dkim_qp_decode off-by-one

• Trusted Domain Project OpenDKIM
• CWE-189
• CWE-193

Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.

• RTI Connext Professional
• Memory corruption
• CWE-193

Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent

• netdata
• Denial of service
• CWE-193

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p

• Memory corruption
• CWE-193

ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

• CWE-193

<4.16.0 · fixed in 4.16.0

alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()

• ALSA Project alsa-lib
• CWE-193

Microsoft Excel Remote Code Execution Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Excel 2016
• Memory corruption
• CWE-193

Win32k Information Disclosure Vulnerability

• Microsoft Office 365 for Mac
• Microsoft Office for Android
• Memory corruption
• CWE-193

D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one

• D-Link DIR-605
• CWE-189
• CWE-193

Stack-based buffer overflow in OpenVPN

• OpenVPN
• Memory corruption
• CWE-193

PJSIP: SIP message header buffer overflow

• pjsip pjproject
• CWE-193

MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in Serial Telegram Handling

• themoos core-moos
• CWE-193

Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser

• zephyr
• Memory corruption
• CWE-193

Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

• Apache Software Foundation Apache Tomcat
• CWE-193

Off-by-one error in Google Chrome

• Google Chrome
• CWE-193

hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()

• hashcat
• CWE-193

Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

• libevent
• Memory corruption
• CWE-193

FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments

• FreeRDP
• Memory corruption
• CWE-193

nimiq-blockchain: Validity store off by one error

• Authentication bypass
• CWE-193

<1.5.1 · fixed in 1.5.1

Microsoft Office Word Information Disclosure Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• Memory corruption
• CWE-193

Off-by-One Error in GNU Emacs for Android

• GNU Emacs
• CWE-193

Off-by-one error in OpenVPN

• OpenVPN
• Memory corruption
• CWE-193

ImageMagick: Information Disclosure when printing profiles with debug enabled

• Memory corruption
• CWE-193

<14.15.0 · fixed in 14.15.0

Off-by-one out of bounds read in MIME header parser for forwarding

• Mozilla Thunderbird
• CWE-193

Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN

• NLnet Labs Unbound
• CWE-193

Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Memory corruption
• CWE-193

Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• CWE-193

IKEv2 Denial of Service via malformed fragmentation

• libreswan
• Denial of service
• CWE-193

UltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsing

• uvnc UltraVNC
• Memory corruption
• CWE-193

UltraVNC repeater wi_uudecode off-by-one in base64 decode boundary check

• uvnc UltraVNC
• CWE-193

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

• GNOME GLib
• Red Hat Enterprise Linux 10
• CWE-193

Off-by-one error in w1.fi hostapd

• w1.fi hostapd
• CWE-193

CANBoat - Off-by-One Global Buffer Overflow in searchForPgn()

• canboat
• CWE-193

RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Message

• tomojitakasu RTKLIB
• CWE-193

net: bcmgenet: fix off-by-one in bcmgenet_put_txcb

• Linux kernel
• CWE-193

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation

• CWE-193

<0.14.3 · fixed in 0.14.3

Heap buffer overflow in Calc formula compilation

• The Document Foundation LibreOffice
• Memory corruption
• CWE-193

nanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length Field

• debevv nanoMODBUS
• Memory corruption
• CWE-193

bit7z: Path Traversal via Null Byte Injection from `gcount()` Off-by-One in `restoreSymlink()`

• rikyoz bit7z
• Path traversal
• CWE-193