# CWE-195.

Every Advisory and CVE whose sources give the weakness CWE-195, newest first.

## Records, newest first

- [ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute](https://agentprime.io/advisories/GHSA-m4pr-6v3c-6fgr.md)
  `GHSA-m4pr-6v3c-6fgr`, `CVE-2026-115921` · PyPI `onnx`: affected `>=1.4.0, <1.22.0`, fixed in `1.22.0` · CVSS 6.2 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption, CWE-195
- [Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer](https://agentprime.io/advisories/CVE-2026-115679.md)
  `CVE-2026-115679` · CVE record: Keil MDK-Middleware · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-195
- [Keil MDK-Middleware: Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in…](https://agentprime.io/advisories/CVE-2026-115678.md)
  `CVE-2026-115678` · CVE record: Keil MDK-Middleware · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-195
- [Out-of-Bounds Read via Unchecked Length Values](https://agentprime.io/advisories/CVE-2026-82943.md)
  `CVE-2026-82943` · CVE record: RT-Labs AB SOEM · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption, Information disclosure, CWE-195
- [Memory Corruption via Integer Underflow in Message Length Validation](https://agentprime.io/advisories/CVE-2026-70388.md)
  `CVE-2026-70388` · CVE record: RT-Labs AB SOEM · CVSS 8.3 High · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption, CWE-195
- [Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used](https://agentprime.io/advisories/CVE-2026-101937.md)
  `CVE-2026-101937` · CVE record: Juniper Networks Junos OS · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-195
- [godotengine Godot Engine: Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader…](https://agentprime.io/advisories/CVE-2026-110735.md)
  `CVE-2026-110735` · CVE record: godotengine Godot Engine · CVSS 2.5 Low · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-195
- [MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender](https://agentprime.io/advisories/CVE-2026-17507.md)
  `CVE-2026-17507` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-195
- [U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK](https://agentprime.io/advisories/CVE-2026-74221.md)
  `CVE-2026-74221` · CVE record: u-boot u-boot · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-195
- [U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply](https://agentprime.io/advisories/CVE-2026-74220.md)
  `CVE-2026-74220` · CVE record: u-boot u-boot · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-195
- [MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization](https://agentprime.io/advisories/CVE-2026-102639.md)
  `CVE-2026-102639` · CVE record: MobilityDB MobilityDB · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-195
- [RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration](https://agentprime.io/advisories/GHSA-rm6m-hrcw-jw33.md)
  `GHSA-rm6m-hrcw-jw33`, `CVE-2026-77406`, `GO-2026-6502` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 8.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-195
- [Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software TCP DNS Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20248.md)
  `CVE-2026-20248` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-195
- [MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Length](https://agentprime.io/advisories/CVE-2026-85441.md)
  `CVE-2026-85441` · CVE record: themoos core-moos · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-195
- [Integer Conversion Vulnerability Resulting in an Out of Bounds Read in NI LabVIEW](https://agentprime.io/advisories/CVE-2026-18444.md)
  `CVE-2026-18444` · CVE record: NI LabVIEW · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-195
- [Coturn: Pre-authentication heap memory disclosure in ACME redirect (\`try_acme_redirect\`)](https://agentprime.io/advisories/CVE-2026-62959.md)
  `CVE-2026-62959` · CVE record: coturn coturn · CVSS 8.2 High · Not analysed yet · Published 31 Jul 2026 · Tags: Memory corruption, CWE-195
- [Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder](https://agentprime.io/advisories/CVE-2026-55737.md)
  `CVE-2026-55737` · CVE record: Erlang OTP · CVSS 5.1 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Memory corruption, CWE-195
- [Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2](https://agentprime.io/advisories/CVE-2026-55991.md)
  `CVE-2026-55991` · CVE record: NLnet Labs Unbound · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-195
- [FreeSWITCH: Pre-authentication heap buffer overflow in libesl \`Content-Length\` parsing](https://agentprime.io/advisories/CVE-2026-49840.md)
  `CVE-2026-49840` · CVE record: signalwire freeswitch · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption, CWE-20, CWE-195
- [pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion](https://agentprime.io/advisories/CVE-2026-41682.md)
  `CVE-2026-41682` · CVE record: pupnp pupnp · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Server-side request forgery (SSRF), CWE-195
- [OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp](https://agentprime.io/advisories/GHSA-q6vj-wxvf-5m8c.md)
  `GHSA-q6vj-wxvf-5m8c`, `CVE-2026-26981`, `PYSEC-2026-2849` · PyPI `openexr`: affected `>=3.3.0, <3.3.7 || >=3.4.0, <3.4.5`, fixed in `3.3.7`, `3.4.5` · CVSS 6.5 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-195
- [Sequoia PGP has Subtraction Overflow when aes_key_unwrap function is provided ciphertext that is too short](https://agentprime.io/advisories/GHSA-v6x3-9r38-r27q.md)
  `GHSA-v6x3-9r38-r27q`, `CVE-2025-67897`, `RUSTSEC-2025-0136` · crates.io `sequoia-openpgp`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 5.3 Medium · Not analysed yet · Published 14 Dec 2025 · Tags: CWE-195
- [Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted TLS certificate that causes i2d_X509(…](https://agentprime.io/advisories/CVE-2025-65495.md)
  `CVE-2025-65495` · CVE record · CVSS 7.5 High · Not analysed yet · Published 24 Nov 2025 · Tags: CWE-195
- [llama.cpp tokenizer signed vs. unsigned heap overflow](https://agentprime.io/advisories/CVE-2025-52566.md)
  `CVE-2025-52566` · CVE record: ggml-org llama.cpp · CVSS 8.6 High · Not analysed yet · Published 24 Jun 2025 · Tags: Memory corruption, CWE-195
- [llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Model](https://agentprime.io/advisories/CVE-2025-49847.md)
  `CVE-2025-49847` · CVE record: ggml-org llama.cpp · CVSS 8.8 High · Not analysed yet · Published 17 Jun 2025 · Tags: Memory corruption, CWE-195
- [Junos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crash](https://agentprime.io/advisories/CVE-2025-30646.md)
  `CVE-2025-30646` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.1 High · Not analysed yet · Published 9 Apr 2025 · Tags: CWE-195
- [Snowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Error](https://agentprime.io/advisories/CVE-2025-24792.md)
  `CVE-2025-24792` · CVE record: snowflakedb pdo_snowflake · CVSS 4.4 Medium · Not analysed yet · Published 29 Jan 2025 · Tags: CWE-195
- [drivers/wlan/wlan_mgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow.](https://agentprime.io/advisories/CVE-2024-25388.md)
  `CVE-2024-25388` · CVE record · CVSS 8.4 High · Not analysed yet · Published 27 Mar 2024 · Tags: CWE-195
- [Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability.](https://agentprime.io/advisories/CVE-2023-28063.md)
  `CVE-2023-28063` · CVE record: Dell CPG BIOS · CVSS 6.7 Medium · Not analysed yet · Published 6 Feb 2024 · Tags: CWE-195
- [Signed-to-unsigned conversion error in Audio](https://agentprime.io/advisories/CVE-2023-33034.md)
  `CVE-2023-33034` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 3 Oct 2023 · Tags: CWE-195
- [Potential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driver](https://agentprime.io/advisories/CVE-2023-5184.md)
  `CVE-2023-5184` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.0 High · Not analysed yet · Published 27 Sept 2023 · Tags: Memory corruption, CWE-195
- [Okio Signed to Unsigned Conversion Error vulnerability](https://agentprime.io/advisories/GHSA-w33c-445m-f8w7.md)
  `GHSA-w33c-445m-f8w7`, `CVE-2023-3635` · Maven `com.squareup.okio:okio` and 1 more: affected `>=2.0.0-RC1, <3.4.0 || <1.17.6`, fixed in `3.4.0`, `1.17.6` · CVSS 5.9 Medium · Not analysed yet · Published 12 Jul 2023 · Tags: CWE-195, CWE-681
- [WellinTech KingHistorian: An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality…](https://agentprime.io/advisories/CVE-2022-43663.md)
  `CVE-2022-43663` · CVE record: WellinTech KingHistorian · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 20 Mar 2023 · Tags: CWE-195
- [Signed to Unsigned Conversion Error in Facebook Hermes](https://agentprime.io/advisories/GHSA-gmpm-xp43-f7g6.md)
  `GHSA-gmpm-xp43-f7g6`, `CVE-2020-1913` · npm `hermes-engine`: affected `<0.5.2`, fixed in `0.5.2` · CVSS 8.1 High · Not analysed yet · Published 24 May 2022 · Tags: CWE-195, CWE-681
- [GNU glibc: An exploitable signed comparison vulnerability exists in the ARMv7 memcpy()…](https://agentprime.io/advisories/CVE-2020-6096.md)
  `CVE-2020-6096` · CVE record: GNU glibc · CVSS 8.1 High · Not analysed yet · Published 1 Apr 2020 · Tags: CWE-195
- [illumos osnet-incorporation: illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of…](https://agentprime.io/advisories/CVE-2016-6560.md)
  `CVE-2016-6560` · CVE record: illumos osnet-incorporation · No CVSS score · Not analysed yet · Published 31 Mar 2017 · Tags: CWE-195
- [Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a de…](https://agentprime.io/advisories/CVE-2011-3045.md)
  `CVE-2011-3045` · CVE record · CVSS 8.8 High · Not analysed yet · Published 22 Mar 2012 · Tags: CWE-195

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-195>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-195/>. Everything for agents: <https://agentprime.io/llms.txt>.