Common Weakness Enumeration

CWE-125

Allowed

Out-of-bounds Read

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product reads data past the end, or before the beginning, of the intended buffer.

13230 vulnerabilities reference this CWE, most recent first.

CVE-2026-110716 (GCVE-0-2026-110716)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:01 – Updated: 2026-10-14 15:01
VLAI
Title
unshield through 1.6.2 Heap Out-of-Bounds Read via unshield_get_file_table
Summary
unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range file_table_offset or large file counts to crash the unshield tool or library consumers.
Severity
6.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6045 records in the last 180 days details
References
Impacted products
Vendor Product Version
twogood unshield Affected: 0 , ≤ 1.6.2 (semver)
    cpe:2.3:a:unshield_project:unshield:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-14 00:00
Credits
HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/twogood/unshield",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/twogood/unshield",
          "product": "unshield",
          "repo": "https://github.com/twogood/unshield",
          "vendor": "twogood",
          "versions": [
            {
              "lessThanOrEqual": "1.6.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:unshield_project:unshield:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range file_table_offset or large file counts to crash the unshield tool or library consumers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:01:30.522Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://hackmd.io/@haind-pwn/unshield-header-filetable-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/twogood/unshield/blob/51de441ba6893f11026d4671ccef9e8e2a4634fa/lib/libunshield.c#L195"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/twogood/unshield"
        },
        {
          "name": "VulnCheck Advisory: unshield through 1.6.2 Heap Out-of-Bounds Read via unshield_get_file_table",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/unshield-through-1.6.2-heap-out-of-bounds-read-via-unshield-get-file-table"
        }
      ],
      "title": "unshield through 1.6.2 Heap Out-of-Bounds Read via unshield_get_file_table",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110716",
    "datePublished": "2026-10-14T15:01:30.522Z",
    "dateReserved": "2026-10-14T14:39:53.359Z",
    "dateUpdated": "2026-10-14T15:01:30.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110713 (GCVE-0-2026-110713)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:01 – Updated: 2026-10-14 15:01
VLAI
Title
libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders
Summary
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6045 records in the last 180 days details
References
Impacted products
Vendor Product Version
sahlberg libsmb2 Affected: 0 , ≤ 6.2 (custom)
Create a notification for this product.
Date Public
2026-07-28 00:00
Credits
Benjamin Ali HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/sahlberg/libsmb2",
          "defaultStatus": "unaffected",
          "product": "libsmb2",
          "repo": "https://github.com/sahlberg/libsmb2",
          "vendor": "sahlberg",
          "versions": [
            {
              "lessThanOrEqual": "6.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Benjamin Ali"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-07-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:01:28.343Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://hackmd.io/@haind-pwn/libsmb2-query-info-reply-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/sahlberg/libsmb2/blob/d67e213a5c4e7e4969fd81f0b95e4ca5831fbba1/lib/smb2-data-filesystem-info.c#L71"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/sahlberg/libsmb2/commit/dd0bbdee24bb56f7ec95431afc07ce0a666533f7"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/sahlberg/libsmb2"
        },
        {
          "name": "VulnCheck Advisory: libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/libsmb2-through-6.2-heap-out-of-bounds-read-via-file-system-info-decoders"
        }
      ],
      "title": "libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110713",
    "datePublished": "2026-10-14T15:01:28.343Z",
    "dateReserved": "2026-10-14T14:39:52.266Z",
    "dateUpdated": "2026-10-14T15:01:28.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110712 (GCVE-0-2026-110712)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:01 – Updated: 2026-10-14 17:40
VLAI
Title
libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info
Summary
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:39 UTC
CWE
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6045 records in the last 180 days details
References
Impacted products
Vendor Product Version
sahlberg libsmb2 Affected: 0 , ≤ 6.2 (custom)
Create a notification for this product.
Date Public
2026-06-09 00:00
Credits
tonghuaroot HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110712",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T17:39:48.080087Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T17:40:05.910Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/sahlberg/libsmb2",
          "defaultStatus": "unaffected",
          "product": "libsmb2",
          "repo": "https://github.com/sahlberg/libsmb2",
          "vendor": "sahlberg",
          "versions": [
            {
              "lessThanOrEqual": "6.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "tonghuaroot"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:01:27.547Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://hackmd.io/@haind-pwn/libsmb2-query-info-reply-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/sahlberg/libsmb2/blob/d67e213a5c4e7e4969fd81f0b95e4ca5831fbba1/lib/smb2-data-file-info.c#L202"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/sahlberg/libsmb2/commit/57bee9fb941a39307145b82e4dd1718862f30a74"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/sahlberg/libsmb2"
        },
        {
          "name": "VulnCheck Advisory: libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/libsmb2-through-6.2-heap-out-of-bounds-read-via-smb2-decode-file-all-info"
        }
      ],
      "title": "libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110712",
    "datePublished": "2026-10-14T15:01:27.547Z",
    "dateReserved": "2026-10-14T14:39:51.944Z",
    "dateUpdated": "2026-10-14T17:40:05.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110661 (GCVE-0-2026-110661)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:01 – Updated: 2026-10-14 15:01
VLAI
Title
CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header
Summary
CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI_stridx_c to scan past disk_node_data, crashing tools like cgnslist.
Severity
4.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6045 records in the last 180 days details
References
Impacted products
Vendor Product Version
CGNS CGNS Affected: 0 , ≤ 4.5.2 (semver)
Create a notification for this product.
Date Public
2026-10-14 00:00
Credits
HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/CGNS/CGNS",
          "defaultStatus": "unaffected",
          "product": "CGNS",
          "repo": "https://github.com/CGNS/CGNS",
          "vendor": "CGNS",
          "versions": [
            {
              "lessThanOrEqual": "4.5.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI_stridx_c to scan past disk_node_data, crashing tools like cgnslist."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:01:26.787Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://hackmd.io/@haind-pwn/cgns-adf-node-header-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/CGNS/CGNS/blob/3a972d92559787a49c5f9a54974ea1946ecb9d21/src/adf/ADF_internals.c#L6828"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/CGNS/CGNS"
        },
        {
          "name": "VulnCheck Advisory: CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cgns-through-4.5.2-stack-out-of-bounds-read-via-adfi-read-node-header"
        }
      ],
      "title": "CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110661",
    "datePublished": "2026-10-14T15:01:26.787Z",
    "dateReserved": "2026-10-14T13:08:41.030Z",
    "dateUpdated": "2026-10-14T15:01:26.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110660 (GCVE-0-2026-110660)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:01 – Updated: 2026-10-14 15:01
VLAI
Title
vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder
Summary
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application.
Severity
4.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6045 records in the last 180 days details
References
Impacted products
Vendor Product Version
vgmstream vgmstream Affected: 0 , ≤ r2117 (custom)
Create a notification for this product.
Date Public
2026-10-14 00:00
Credits
HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/vgmstream/vgmstream",
          "defaultStatus": "unaffected",
          "product": "vgmstream",
          "repo": "https://github.com/vgmstream/vgmstream",
          "vendor": "vgmstream",
          "versions": [
            {
              "lessThanOrEqual": "r2117",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:01:26.072Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://hackmd.io/@haind-pwn/vgmstream-g7221-bitreader-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/vgmstream/vgmstream/blob/71e2361042531fe767fb98300cf8c1ee95e539a0/src/coding/libs/g7221_lib.c#L838"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/vgmstream/vgmstream"
        },
        {
          "name": "VulnCheck Advisory: vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vgmstream-through-r2117-stack-out-of-bounds-read-via-g-722.1-siren14-decoder"
        }
      ],
      "title": "vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110660",
    "datePublished": "2026-10-14T15:01:26.072Z",
    "dateReserved": "2026-10-14T13:08:40.685Z",
    "dateUpdated": "2026-10-14T15:01:26.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110658 (GCVE-0-2026-110658)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:01 – Updated: 2026-10-14 15:01
VLAI
Title
Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse
Summary
Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6045 records in the last 180 days details
References
Impacted products
Vendor Product Version
freeswitch sofia-sip Affected: 0 , ≤ 1.13.18 (semver)
    cpe:2.3:a:signalwire:sofia-sip:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-14 00:00
Credits
HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/freeswitch/sofia-sip",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/freeswitch/sofia-sip",
          "product": "sofia-sip",
          "repo": "https://github.com/freeswitch/sofia-sip",
          "vendor": "freeswitch",
          "versions": [
            {
              "lessThanOrEqual": "1.13.18",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:signalwire:sofia-sip:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.13.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:01:24.633Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://hackmd.io/@haind-pwn/sofia-sip-multipart-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/freeswitch/sofia-sip/blob/ad36ac8f755308e8b87f98a505e83d4e408e5cc3/libsofia-sip-ua/msg/msg_mime.c#L404"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/freeswitch/sofia-sip"
        },
        {
          "name": "VulnCheck Advisory: Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/sofia-sip-through-1.13.18-heap-out-of-bounds-read-via-msg-multipart-parse"
        }
      ],
      "title": "Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110658",
    "datePublished": "2026-10-14T15:01:24.633Z",
    "dateReserved": "2026-10-14T13:08:39.968Z",
    "dateUpdated": "2026-10-14T15:01:24.633Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110656 (GCVE-0-2026-110656)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:01 – Updated: 2026-10-14 15:01
VLAI
Title
miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt
Summary
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.
Severity
2.3 (Low)
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
3.1 (Low)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6045 records in the last 180 days details
References
Impacted products
Vendor Product Version
miniupnp project miniupnpc Affected: 0 , ≤ 2.3.3 (semver)
    cpe:2.3:a:miniupnp_project:miniupnpc:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-06-03 00:00
Credits
HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/miniupnp/miniupnp",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/miniupnp/miniupnp",
          "product": "miniupnpc",
          "repo": "https://github.com/miniupnp/miniupnp",
          "vendor": "miniupnp project",
          "versions": [
            {
              "lessThanOrEqual": "2.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:miniupnp_project:miniupnpc:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-06-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function\u0027s namespace-prefix handling that skips an end-of-buffer check after advancing past \u0027:\u0027. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in \u0027:\u0027 within an element name to crash the client."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:01:23.198Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://hackmd.io/@haind-pwn/miniupnpc-minixml-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/miniupnp/miniupnp/blob/bf4215a7574f88aa55859db9db00e3ae58cf42d6/miniupnpc/src/minixml.c#L141"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/miniupnp/miniupnp/commit/64ef08a12aabab57be0bf7e40f047c8f14dedf9c"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/miniupnp/miniupnp"
        },
        {
          "name": "VulnCheck Advisory: miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/miniupnpc-through-2.3.3-heap-out-of-bounds-read-via-minixml-parseelt"
        }
      ],
      "title": "miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110656",
    "datePublished": "2026-10-14T15:01:23.198Z",
    "dateReserved": "2026-10-14T13:08:39.334Z",
    "dateUpdated": "2026-10-14T15:01:23.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110655 (GCVE-0-2026-110655)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:01 – Updated: 2026-10-14 18:32
VLAI
Title
miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt
Summary
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
Severity
2.3 (Low)
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
3.1 (Low)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:29 UTC
CWE
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6045 records in the last 180 days details
References
Impacted products
Vendor Product Version
miniupnp project miniupnpc Affected: 0 , ≤ 2.3.3 (semver)
    cpe:2.3:a:miniupnp_project:miniupnpc:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-03-23 00:00
Credits
HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110655",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:29:38.906875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:32:15.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/miniupnp/miniupnp",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/miniupnp/miniupnp",
          "product": "miniupnpc",
          "repo": "https://github.com/miniupnp/miniupnp",
          "vendor": "miniupnp project",
          "versions": [
            {
              "lessThanOrEqual": "2.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:miniupnp_project:miniupnpc:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-03-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in \u0027=\u0027 to crash the client."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:01:22.499Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://hackmd.io/@haind-pwn/miniupnpc-minixml-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/miniupnp/miniupnp/blob/bf4215a7574f88aa55859db9db00e3ae58cf42d6/miniupnpc/src/minixml.c#L61"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/miniupnp/miniupnp/commit/3cfb4fb78d5ac04ed0dadc8dd842fc9e448916db"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/miniupnp/miniupnp"
        },
        {
          "name": "VulnCheck Advisory: miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/miniupnpc-through-2.3.3-heap-out-of-bounds-read-via-minixml-parseatt"
        }
      ],
      "title": "miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110655",
    "datePublished": "2026-10-14T15:01:22.499Z",
    "dateReserved": "2026-10-14T13:08:39.018Z",
    "dateUpdated": "2026-10-14T18:32:15.368Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110606 (GCVE-0-2026-110606)

Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 14:16
VLAI
Title
LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader
Summary
LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.
Severity
4.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6045 records in the last 180 days details
References
Impacted products
Vendor Product Version
LibreCAD libdxfrw Affected: 0 , ≤ LC2.2.0 (custom)
Create a notification for this product.
LibreCAD LibreCAD Affected: 0 , ≤ 2.2.1.5 (custom)
Create a notification for this product.
Date Public
2026-05-07 00:00
Credits
dayzsec HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/LibreCAD/libdxfrw",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/LibreCAD/libdxfrw",
          "product": "libdxfrw",
          "repo": "https://github.com/LibreCAD/libdxfrw",
          "vendor": "LibreCAD",
          "versions": [
            {
              "lessThanOrEqual": "LC2.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/LibreCAD/LibreCAD",
          "product": "LibreCAD",
          "repo": "https://github.com/LibreCAD/LibreCAD",
          "vendor": "LibreCAD",
          "versions": [
            {
              "lessThanOrEqual": "2.2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:librecad:libdxfrw:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "lc2.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:librecad:librecad:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.2.1.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "dayzsec"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-05-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T14:16:46.382Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/LibreCAD/LibreCAD/issues/2554"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind-pwn/libdxfrw-dwg-header-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/LibreCAD/libdxfrw/blob/LC2.2.0/src/intern/dwgreader18.cpp#L248"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.5/libraries/libdxfrw/src/intern/dwgreader18.cpp#L248"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/LibreCAD/libdxfrw/commit/0c5595930b20917a40ed7c188475eaca624b8ce9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/LibreCAD/LibreCAD/commit/abd1f4a8e32dbd871c986086227502217200cd4b"
        },
        {
          "name": "VulnCheck Advisory: LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/librecad-libdxfrw-through-lc2-2.0-stack-out-of-bounds-read-via-dwgreader18-readfileheader"
        }
      ],
      "title": "LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110606",
    "datePublished": "2026-10-14T14:16:46.382Z",
    "dateReserved": "2026-10-14T13:07:22.235Z",
    "dateUpdated": "2026-10-14T14:16:46.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110598 (GCVE-0-2026-110598)

Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 15:54
VLAI
Title
Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value
Summary
Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT_MV_STRING8, PT_MV_UNICODE or PT_MV_BINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory.
Severity
6.9 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:49 UTC
CWE
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6045 records in the last 180 days details
References
Impacted products
Vendor Product Version
libyal libpff Affected: 0 , ≤ 20260926 (custom)
Create a notification for this product.
Date Public
2026-10-14 00:00
Credits
HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110598",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T14:49:33.739466Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T15:54:41.505Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/libyal/libpff",
          "product": "libpff",
          "repo": "https://github.com/libyal/libpff",
          "vendor": "libyal",
          "versions": [
            {
              "lessThanOrEqual": "20260926",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT_MV_STRING8, PT_MV_UNICODE or PT_MV_BINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T14:16:40.986Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind-pwn/libpff-multivalue-offset-underflow-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/libyal/libpff/blob/03545511ab7a7a609e50ec715bdd3985c3be71c5/libpff/libpff_record_entry.c#L2825-L2874"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/libyal/libpff/blob/03545511ab7a7a609e50ec715bdd3985c3be71c5/libpff/libpff_multi_value.c#L207-L271"
        },
        {
          "name": "VulnCheck Advisory: Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/libyal-libpff-through-20260926-heap-out-of-bounds-read-via-libpff-record-entry-get-multi-value"
        }
      ],
      "title": "Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110598",
    "datePublished": "2026-10-14T14:16:40.986Z",
    "dateReserved": "2026-10-14T13:07:19.518Z",
    "dateUpdated": "2026-10-14T15:54:41.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design

Strategy: Language Selection

Use a language that provides appropriate memory abstractions.

CAPEC-540: Overread Buffers

An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

← Back to the CWE list