Common Weakness Enumeration

CWE-125

Weakness Allowed

Out-of-bounds Read

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product reads data past the end, or before the beginning, of the intended buffer.

Dimensions

Behavior-Type: Read
Resource-Type: Memory Buffer
Resource-Property: Out-of-bounds

Mapping guidance

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members

ChildOf: CWE-119 · View CWE-1000

ChildOf: CWE-119 · View CWE-1003

ChildOf: CWE-119 · View CWE-1305

ChildOf: CWE-119 · View CWE-1340

Modes of introduction

Implementation

Detection methods

Fuzzing

Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.

Effectiveness: High

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Automated Dynamic Analysis

Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].

Effectiveness: Moderate

Crafted inputs are necessary to reach the code containing the error, such as generated by fuzzers. Also, these tools may reduce performance, and they only report the error condition - not the original mistake that led to the error.

Content history

Submission: PLOVER · 2006-07-19 · CWE Draft 3

Contribution: Abhi Balakrishnan · 2024-02-29 · CWE 4.15

Provided diagram to improve CWE usability

Modification: CWE Content Team · MITRE · 2008-09-08 · CWE 1.0

updated Applicable_Platforms, Relationships, Taxonomy_Mappings, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2009-10-29 · CWE 1.6

updated Description

Modification: CWE Content Team · MITRE · 2010-09-27 · CWE 1.10

updated Relationships

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated Demonstrative_Examples, References, Relationships

Modification: CWE Content Team · MITRE · 2014-06-23 · CWE 2.7

updated Related_Attack_Patterns

Modification: CWE Content Team · MITRE · 2014-07-30 · CWE 2.8

updated Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2015-12-07 · CWE 2.9

updated Relationships

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Causal_Nature, Observed_Examples, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2018-03-27 · CWE 3.1

updated Description

Modification: CWE Content Team · MITRE · 2019-01-03 · CWE 3.2

updated Relationships

Modification: CWE Content Team · MITRE · 2019-06-20 · CWE 3.3

updated Description, Related_Attack_Patterns

Modification: CWE Content Team · MITRE · 2019-09-19 · CWE 3.4

updated Common_Consequences, Observed_Examples, Potential_Mitigations, References, Relationships

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Potential_Mitigations, Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2020-06-25 · CWE 4.1

updated Observed_Examples, Potential_Mitigations

Modification: CWE Content Team · MITRE · 2020-08-20 · CWE 4.2

updated Observed_Examples, Potential_Mitigations, Relationships

Modification: CWE Content Team · MITRE · 2020-12-10 · CWE 4.3

updated Related_Attack_Patterns, Relationships

Modification: CWE Content Team · MITRE · 2021-07-20 · CWE 4.5

updated Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2022-04-28 · CWE 4.7

updated Research_Gaps

Modification: CWE Content Team · MITRE · 2022-06-28 · CWE 4.8

updated Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2022-10-13 · CWE 4.9

updated Applicable_Platforms, Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2023-01-31 · CWE 4.10

updated Description

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Detection_Factors, References, Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes, Relationships

Modification: CWE Content Team · MITRE · 2023-10-26 · CWE 4.13

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2024-07-16 · CWE 4.15

updated Alternate_Terms, Common_Consequences, Description, Diagram, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2024-11-19 · CWE 4.16

updated Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2025-09-09 · CWE 4.18

updated Affected_Resources, Demonstrative_Examples, Functional_Areas

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Applicable_Platforms, Detection_Factors, References, Relationships

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Applicable_Platforms, Demonstrative_Examples, Dimensions, Observed_Examples, References, Relationships, Taxonomy_Mappings

13882 vulnerabilities reference this CWE, most recent first.

CVE-2026-123269 (GCVE-0-2026-123269)

Vulnerability from cvelistv5 – Published: 2026-11-06 00:00 – Updated: 2026-11-06 17:44 X_Open Source

Title

libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds

Summary

A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

3.3 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 17:44 UTC

CWE

CWE-125 - Out-of-Bounds Read
CWE-119 - Memory Corruption

Assigner

VulDB CNA under the mitre root

CNA scorecard B 83/100 over 3776 records in the last 180 days details

References

8 references

URL	Tags
https://vuldb.com/vuln/431575	vdb-entrytechnical-description
https://vuldb.com/vuln/431575/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-123269	third-party-advisory
https://vuldb.com/submit/1032842	third-party-advisory
https://github.com/libyal/libvmdk/issues/41	issue-tracking
https://github.com/user-attachments/files/3339423…	exploit
https://github.com/libyal/libvmdk/commit/175d3fc0…	patch
https://github.com/libyal/libvmdk/	product

Impacted products

1 product

Vendor	Product	Version
libyal	libvmdk	Affected: n/a cpe:2.3:a:libyal:libvmdk::::::::

Credits

fczhang (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123269",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T17:44:17.214676Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T17:44:33.655Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:libyal:libvmdk:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Descriptor File Parser"
          ],
          "product": "libvmdk",
          "vendor": "libyal",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "fczhang (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-Bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T00:00:33.592Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-431575 | libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/431575"
        },
        {
          "name": "VDB-431575 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/431575/cti"
        },
        {
          "name": "CVE-2026-123269 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-123269"
        },
        {
          "name": "Submit #1032842 | libyal (Joachim Metz) libvmdk 396e1873a030ac535bf919f6707d5be57613ae08` Memory corruption",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1032842"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/libyal/libvmdk/issues/41"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/user-attachments/files/33394231/03_integer_underflow_poc.zip"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/libyal/libvmdk/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-05T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-05T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-05T19:16:39.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-123269",
    "datePublished": "2026-11-06T00:00:33.592Z",
    "dateReserved": "2026-11-05T18:11:21.135Z",
    "dateUpdated": "2026-11-06T17:44:33.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-122189 (GCVE-0-2026-122189)

Vulnerability from cvelistv5 – Published: 2026-11-05 03:00 – Updated: 2026-11-05 20:51

Title

OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds

Summary

A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 20:51 UTC

CWE

CWE-125 - Out-of-Bounds Read
CWE-119 - Memory Corruption

Assigner

VulDB CNA under the mitre root

CNA scorecard B 83/100 over 3776 records in the last 180 days details

References

7 references

URL	Tags
https://vuldb.com/vuln/431163	vdb-entrytechnical-description
https://vuldb.com/vuln/431163/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-122189	third-party-advisory
https://vuldb.com/submit/1028313	third-party-advisory
https://github.com/OpenPPL/ppl.nn/issues/975	issue-tracking
https://github.com/user-attachments/files/3339300…	exploit
https://github.com/OpenPPL/ppl.nn/	product

Impacted products

1 product

Vendor	Product	Version
OpenPPL	ppl.nn	Affected: bb84dc9952809b3a5a0036858a3d9f68af1c83d5 cpe:2.3:a:openppl:ppl.nn::::::::

Credits

Dem000000 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-122189",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T20:51:35.756999Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T20:51:45.837Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:openppl:ppl.nn:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "CUDA Optimizer"
          ],
          "product": "ppl.nn",
          "vendor": "OpenPPL",
          "versions": [
            {
              "status": "affected",
              "version": "bb84dc9952809b3a5a0036858a3d9f68af1c83d5"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Dem000000 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-Bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T03:00:48.902Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-431163 | OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/431163"
        },
        {
          "name": "VDB-431163 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/431163/cti"
        },
        {
          "name": "CVE-2026-122189 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-122189"
        },
        {
          "name": "Submit #1028313 | OpenPPL ppl.nn commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5 Out-of-bounds Read",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1028313"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/OpenPPL/ppl.nn/issues/975"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/user-attachments/files/33393000/poc.zip"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/OpenPPL/ppl.nn/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-04T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-04T20:14:03.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-122189",
    "datePublished": "2026-11-05T03:00:48.902Z",
    "dateReserved": "2026-11-04T19:08:58.956Z",
    "dateUpdated": "2026-11-05T20:51:45.837Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121942 (GCVE-0-2026-121942)

Vulnerability from cvelistv5 – Published: 2026-11-04 12:31 – Updated: 2026-11-04 18:53

Title

ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c

Summary

ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 18:52 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7427 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/mchehab/zbar/issues/351	issue-tracking
https://hackmd.io/@haindpwn/zbar-sqcode-sampling-…	third-party-advisory
https://github.com/mchehab/zbar/blob/0.23.95/zbar…	technical-description
https://www.vulncheck.com/advisories/zbar-through…	third-party-advisory
https://hackmd.io/@haindpwn/cve-2026-121942-zbar-…	exploit

Impacted products

1 product

Vendor	Product	Version
mchehab	zbar	Affected: 0 , ≤ 0.23.95 (semver)

Date Public

2026-10-22 02:11

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121942",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:52:37.472258Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T18:53:01.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@haindpwn/cve-2026-121942-zbar-sqcode-sampling-oob-read"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/mchehab/zbar",
          "product": "zbar",
          "repo": "https://github.com/mchehab/zbar",
          "vendor": "mchehab",
          "versions": [
            {
              "lessThanOrEqual": "0.23.95",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-22T02:11:39.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T12:31:20.522Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/mchehab/zbar/issues/351"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haindpwn/zbar-sqcode-sampling-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mchehab/zbar/blob/0.23.95/zbar/sqcode.c#L529-L567"
        },
        {
          "name": "VulnCheck Advisory: ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zbar-through-0.23.95-out-of-bounds-read-via-zbar-sq-decode-in-sqcode-c"
        }
      ],
      "title": "ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-121942",
    "datePublished": "2026-11-04T12:31:20.522Z",
    "dateReserved": "2026-11-04T12:05:50.614Z",
    "dateUpdated": "2026-11-04T18:53:01.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121626 (GCVE-0-2026-121626)

Vulnerability from cvelistv5 – Published: 2026-11-03 17:13 – Updated: 2026-11-07 03:19

Title

GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler

Summary

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-07 03:19 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7427 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/willamowius/gnugk/commit/160aa…	patch
https://github.com/willamowius/gnugk/releases/tag/v5_16	release-notes
https://github.com/willamowius/gnugk/blob/v5_15/G…	technical-description
https://github.com/willamowius/gnugk	product
https://www.vulncheck.com/advisories/gnu-gatekeep…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
willamowius	gnugk	Affected: 0 , < 5.16 (custom)

Date Public

2026-08-25 00:00

Credits

Tristan Madani (Talence Security) Jan Willamowius

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121626",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T03:19:14.533230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T03:19:22.751Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "gnugk",
          "vendor": "willamowius",
          "versions": [
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani (Talence Security)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jan Willamowius"
        }
      ],
      "datePublic": "2026-08-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T17:13:53.309Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/willamowius/gnugk/commit/160aa27344ecc9a443cccaa63e8d7fa95a766610"
        },
        {
          "name": "gnugk v5_16 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/willamowius/gnugk/releases/tag/v5_16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/willamowius/gnugk/blob/v5_15/GkClient.cxx#L963-L990"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/willamowius/gnugk"
        },
        {
          "name": "VulnCheck Advisory: GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-in-h-460.24-rtcp-probe-handler"
        }
      ],
      "title": "GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-121626",
    "datePublished": "2026-11-03T17:13:53.309Z",
    "dateReserved": "2026-11-03T16:57:44.441Z",
    "dateUpdated": "2026-11-07T03:19:22.751Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121625 (GCVE-0-2026-121625)

Vulnerability from cvelistv5 – Published: 2026-11-03 17:13 – Updated: 2026-11-03 17:24

Title

GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing

Summary

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-03 17:24 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7427 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/willamowius/gnugk/commit/e8939…	patch
https://github.com/willamowius/gnugk/releases/tag/v5_16	release-notes
https://github.com/willamowius/gnugk/blob/v5_15/P…	technical-description
https://github.com/willamowius/gnugk	product
https://www.vulncheck.com/advisories/gnu-gatekeep…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
willamowius	gnugk	Affected: 0 , < 5.16 (custom)

Date Public

2026-08-25 00:00

Credits

Tristan Madani (Talence Security) Jan Willamowius

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121625",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T17:24:07.685551Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T17:24:49.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "gnugk",
          "vendor": "willamowius",
          "versions": [
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani (Talence Security)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jan Willamowius"
        }
      ],
      "datePublic": "2026-08-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T17:13:52.678Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/willamowius/gnugk/commit/e8939d03b0b2ef46e356f3144a6ee14f2920b777"
        },
        {
          "name": "gnugk v5_16 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/willamowius/gnugk/releases/tag/v5_16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/willamowius/gnugk/blob/v5_15/ProxyChannel.cxx#L14867-L14895"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/willamowius/gnugk"
        },
        {
          "name": "VulnCheck Advisory: GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-via-rtcp-sdes-parsing"
        }
      ],
      "title": "GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-121625",
    "datePublished": "2026-11-03T17:13:52.678Z",
    "dateReserved": "2026-11-03T16:57:44.037Z",
    "dateUpdated": "2026-11-03T17:24:49.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121604 (GCVE-0-2026-121604)

Vulnerability from cvelistv5 – Published: 2026-11-03 16:26 – Updated: 2026-11-07 03:14

Title

wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c

Summary

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-07 03:14 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7427 records in the last 180 days details

References

7 references

URL	Tags
https://gitlab.freedesktop.org/wlroots/wlroots/-/…	issue-tracking
https://gitlab.freedesktop.org/wlroots/wlroots/-/…	issue-tracking
https://gitlab.freedesktop.org/wlroots/wlroots/-/…	patch
https://gitlab.freedesktop.org/wlroots/wlroots/-/…	patch
https://gitlab.freedesktop.org/wlroots/wlroots/-/…	release-notes
https://gitlab.freedesktop.org/wlroots/wlroots/-/…	technical-description
https://www.vulncheck.com/advisories/wlroots-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
wlroots	wlroots	Affected: 0 , < 0.20.2 (semver)

Date Public

2026-05-21 00:00

Credits

Tristan Madani (Talence Security) Simon Ser

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121604",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T03:14:25.336787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T03:14:36.532Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.freedesktop.org/wlroots/wlroots",
          "defaultStatus": "unaffected",
          "product": "wlroots",
          "repo": "https://gitlab.freedesktop.org/wlroots/wlroots",
          "vendor": "wlroots",
          "versions": [
            {
              "lessThan": "0.20.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani (Talence Security)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Simon Ser"
        }
      ],
      "datePublic": "2026-05-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T16:26:55.569Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://gitlab.freedesktop.org/wlroots/wlroots/-/work_items/4092"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://gitlab.freedesktop.org/wlroots/wlroots/-/merge_requests/5374"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/851cdd0089004884bd85a95ad21f04009cb5a53a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/4412992469540b1d578cb94a5cd4e6e5829812dc"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://gitlab.freedesktop.org/wlroots/wlroots/-/releases/0.20.2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://gitlab.freedesktop.org/wlroots/wlroots/-/blob/0.20.1/xwayland/xwm.c#L661-L678"
        },
        {
          "name": "VulnCheck Advisory: wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/wlroots-before-0.20.2-out-of-bounds-read-via-read-surface-class-in-xwm-c"
        }
      ],
      "title": "wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-121604",
    "datePublished": "2026-11-03T16:26:55.569Z",
    "dateReserved": "2026-11-03T16:19:16.465Z",
    "dateUpdated": "2026-11-07T03:14:36.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121511 (GCVE-0-2026-121511)

Vulnerability from cvelistv5 – Published: 2026-11-03 14:18 – Updated: 2026-11-03 15:29

Title

Out-of-bounds Read in µD3TN

Summary

Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter allows Local Attacker to Read Memory and Reliably Cause DoS

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-03 15:16 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitLab CNA under the mitre root

CNA scorecard B 75/100 over 304 records in the last 180 days details

References

1 reference

URL	Tags
https://gitlab.com/d3tn/ud3tn/-/work_items/290

Impacted products

1 product

Vendor	Product	Version
D3TN GmbH	µD3TN	Affected: 0 , < 0.15.2 (semver)

Credits

riccardo.nannini@anvilsecure.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121511",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T15:16:06.013948Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T15:29:27.660Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "\u00b5D3TN",
          "repo": "https://gitlab.com/d3tn/ud3tn",
          "vendor": "D3TN GmbH",
          "versions": [
            {
              "lessThan": "0.15.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "riccardo.nannini@anvilsecure.com"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap Out-of-Bounds Read in \u00b5D3TN BPv6/BPv7 Fragmenter allows Local Attacker to Read Memory and Reliably Cause DoS"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T14:18:14.654Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/d3tn/ud3tn/-/work_items/290"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to version 0.15.2 or above."
        }
      ],
      "title": "Out-of-bounds Read in \u00b5D3TN"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-121511",
    "datePublished": "2026-11-03T14:18:14.654Z",
    "dateReserved": "2026-11-03T14:17:34.659Z",
    "dateUpdated": "2026-11-03T15:29:27.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121505 (GCVE-0-2026-121505)

Vulnerability from cvelistv5 – Published: 2026-11-03 14:17 – Updated: 2026-11-03 18:12

Title

Out-of-bounds Read in NTPsec

Summary

An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-03 18:11 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitLab CNA under the mitre root

CNA scorecard B 75/100 over 304 records in the last 180 days details

References

3 references

URL	Tags
https://gitlab.com/NTPsec/ntpsec/-/commit/caf0eb5…
https://gitlab.com/NTPsec/ntpsec/-/work_items/836
https://gitlab.com/NTPsec/ntpsec/-/work_items/902

Impacted products

1 product

Vendor	Product	Version
NTPsec	NTPsec	Affected: 1.1.4 , < 1.2.4 (semver)

Credits

Artem Nasonov (Astra Linux) found and fixed the issue; Erica Windisch (Cyberdione Labs) analyzed its impact

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T18:11:50.547327Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T18:12:00.515Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NTPsec",
          "repo": "https://gitlab.com/NTPsec/ntpsec",
          "vendor": "NTPsec",
          "versions": [
            {
              "lessThan": "1.2.4",
              "status": "affected",
              "version": "1.1.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Artem Nasonov (Astra Linux) found and fixed the issue; Erica Windisch (Cyberdione Labs) analyzed its impact"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client\u0027s stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T14:17:09.654Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/NTPsec/ntpsec/-/commit/caf0eb5df3c6ddbfc2941389bff0f9146835c021"
        },
        {
          "url": "https://gitlab.com/NTPsec/ntpsec/-/work_items/836"
        },
        {
          "url": "https://gitlab.com/NTPsec/ntpsec/-/work_items/902"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to version 1.2.4 or above."
        }
      ],
      "title": "Out-of-bounds Read in NTPsec"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-121505",
    "datePublished": "2026-11-03T14:17:09.654Z",
    "dateReserved": "2026-11-03T14:16:59.661Z",
    "dateUpdated": "2026-11-03T18:12:00.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121397 (GCVE-0-2026-121397)

Vulnerability from cvelistv5 – Published: 2026-11-03 14:28 – Updated: 2026-11-03 16:06

Title

FreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer()

Summary

FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CF_DIB BI_BITFIELDS image that, when converted to PNG for a local application, embeds client heap bytes into the clipboard image.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-03 16:06 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7427 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 0 , < 3.32.2 (semver) Unaffected: 3.32.2 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-10-19 00:00

Credits

nickallevato

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121397",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T16:06:14.108610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T16:06:40.356Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7w3-32ch-x2jq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.32.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "nickallevato"
        }
      ],
      "datePublic": "2026-10-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CF_DIB BI_BITFIELDS image that, when converted to PNG for a local application, embeds client heap bytes into the clipboard image."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T14:28:01.215Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-x7w3-32ch-x2jq)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7w3-32ch-x2jq"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-over-read-via-winpr-save-png-to-buffer"
        }
      ],
      "title": "FreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-121397",
    "datePublished": "2026-11-03T14:28:01.215Z",
    "dateReserved": "2026-11-03T12:27:30.907Z",
    "dateUpdated": "2026-11-03T16:06:40.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121387 (GCVE-0-2026-121387)

Vulnerability from cvelistv5 – Published: 2026-11-03 14:27 – Updated: 2026-11-03 14:27

Title

FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder

Summary

FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 message shorter than a 33- or 32-byte WAV49 frame to crash the client.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7427 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/freerdp-2.0.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: 2.0.0 , < 3.32.2 (semver) Unaffected: 3.32.2 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-10-19 00:00

Credits

iPlayForSG

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.32.2",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.2",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "iPlayForSG"
        }
      ],
      "datePublic": "2026-10-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 message shorter than a 33- or 32-byte WAV49 frame to crash the client."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T14:27:54.541Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wg7g-gx9g-r96c)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wg7g-gx9g-r96c"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.2-out-of-bounds-read-via-gsm610-wav49-decoder"
        }
      ],
      "title": "FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-121387",
    "datePublished": "2026-11-03T14:27:54.541Z",
    "dateReserved": "2026-11-03T12:26:31.384Z",
    "dateUpdated": "2026-11-03T14:27:54.541Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Mitigation MIT-5

Implementation

Strategy: Input Validation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.

Mitigation

Architecture and Design

Strategy: Language Selection

Use a language that provides appropriate memory abstractions.

CAPEC-540: Overread Buffers

An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

← Back to the CWE list