CWE-193.

Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be

• MusicPlayerDaemon MPD
• CWE-193

Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-193

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp).

• Memory corruption
• CWE-193

ImageMagick: Heap Buffer Over-Write in json and yaml encoder of a single byte due to incorrect fix

• CWE-193

<14.12.0 · fixed in 14.12.0

Off-by-two in papd lp_write()

• Netatalk
• CWE-193

Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy

• rsync
• CWE-193

ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.

• Memory corruption
• CWE-193

<14.13.1 · fixed in 14.13.1

ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

• Memory corruption
• CWE-193

<14.13.1 · fixed in 14.13.1

Off-by-one error in Tor

• Tor
• CWE-193

Velocidex Velociraptor has an off-by-one error

• CWE-193

<0.76.5 · fixed in 0.76.5

Off-by-one error in Postfix

• Postfix
• CWE-193

Off-by-one error in mutt

• mutt
• CWE-193

Netfoil has incorrect allowlist enforcement

• CWE-183
• CWE-193

<0.2.1 · fixed in 0.2.1

BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder

• bacnet-stack
• Memory corruption
• CWE-193

FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..

• FreeRDP
• CWE-193

Emacs: emacs: memory corruption vulnerability when processing svg css

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-193

ImageMagick has has an off-by-one origin validation in allows out-of-bounds read in morphology processing

• Memory corruption
• CWE-193

<14.12.0 · fixed in 14.12.0

ImageMagick has an off-by-one error in MSL decoder could result in crash

• CWE-193

<14.12.0 · fixed in 14.12.0

Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer

• nimiq core-rs-albatross
• Memory corruption
• CWE-193

osrg GoBGP bgp.go DecodeFromBytes off-by-one

• osrg GoBGP
• CWE-189
• CWE-193

Moby has an Off-by-one error in its plugin privilege validation

• Privilege escalation
• CWE-193

* · no fixed version yet

EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing

• everest-core
• CWE-193

Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image

• Red Hat Enterprise Linux 7 Extended Lifecycle Support
• Red Hat Enterprise Linux 8
• CWE-193

Off-by-one error in fontconfig

• fontconfig
• CWE-193

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack

• TODDR XML::Parser
• Memory corruption
• CWE-193

arduino-TuyaOpen WiFiMulti Single-Byte Buffer Overflow Remote Code Execution

• arduino-TuyaOpen
• CWE-193

yauzl contains an off-by-one error

• CWE-193

>=3.2.0, <3.2.1 · fixed in 3.2.1

Envoy affected by off-by-one write in JsonEscaper::escapeString()

• CWE-193

<=1.34.12 || >=1.35.0, <=1.35.8 || >=1.36.0, <=1.36.4 · no fixed version yet

OpenClaw has allowlist exec-guard bypass via env -S

• CWE-184
• CWE-193

<2026.2.23 · fixed in 2026.2.23

xlnt-community xlnt Encrypted XLSX File base64.cpp decode_base64 off-by-one

• xlnt
• CWE-189
• CWE-193

The BACnet Protocol Stack library has an Off-by-one Stack-based Buffer Overflow in tokenizer_string

• bacnet-stack
• CWE-193

ml-dsa's UseHint function has off by two error when r0 equals zero

• CWE-193
• CWE-682

<0.1.0-rc.5 · fixed in 0.1.0-rc.5

Heap Buffer Overflow in iccDEV ToneMap Parser

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-193

iccDEV has unicode buffer overflow in CIccTagTextDescription

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-193

iccDEV has heap buffer overflow in CIccTagLut16::Validate()

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-193

iccDEV has heap buffer overflow in CIccTagLut8::Validate()

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-193

Off-by-one error in Google Chrome

• Google Chrome
• CWE-193

Buffer Over-read, Off-by-one Error vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation, Overread Buffers.

• RTI Connext Professional
• CWE-126
• CWE-193

modpost: fix off by one in is_executable_section()

• Linux kernel
• CWE-193

ImageMagick has a Heap Buffer Overflow in InterpretImageFilename

• Memory corruption
• CWE-193

<14.7.0 · fixed in 14.7.0

Off-by-one error in ES iperf3

• ES iperf3
• CWE-193

Off-by-one error in mbedtls

• mbedtls
• CWE-193

Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-193

GoBGP does not verify that the input length

• CWE-193

* · no fixed version yet

GoBGP panics due to a zero value for softwareVersionLen

• CWE-193

>=3.11.0, <3.35.0 · fixed in 3.35.0

LoongArch: BPF: Fix off-by-one error in build_prologue()

• Linux kernel
• CWE-193

Off-by-one error in pizhenwei atophttpd

• pizhenwei atophttpd
• CWE-193

Off-by-one error in Synology Unified Controller (DSMUC) and others

• Synology Unified Controller (DSMUC)
• Synology Replication Service
• CWE-193

wifi: mt76: mt7925: fix off by one in mt7925_load_clc()

• Linux kernel
• CWE-193

drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq()

• Linux kernel
• CWE-193

Off-by-one error in denx U-Boot

• denx U-Boot
• CWE-193

Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development Platform

• BlackBerry QNX Software Development Platform (SDP)
• CWE-193

wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one

• Linux kernel
• CWE-193

crypto: qat/qat_420xx - fix off by one in uof_get_name()

• Linux kernel
• CWE-193

off-by-one-error

• ABB ASPECT-Enterprise
• ABB NEXUS Series
• CWE-193

Suricata defrag: off by one can lead to policy bypass

• OISF suricata
• CWE-193

bhyve(8) privileged guest escape via USB controller

• FreeBSD
• Memory corruption
• CWE-193

Off-by-one Error in v2fly/v2ray-core in github.com/v2fly/v2ray-core

• CWE-193

* · no fixed version yet

Off-by-one error in Ivanti Avalanche

• Ivanti Avalanche
• CWE-193

Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/afpd/directory.c.

• CWE-193