Common Weakness Enumeration
CWE-126
AllowedBuffer Over-read
Abstraction: Variant · Status: Draft
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
954 vulnerabilities reference this CWE, most recent first.
GHSA-4PPF-RV9C-6QJQ
Vulnerability from github – Published: 2023-01-05 18:30 – Updated: 2023-01-12 00:30
VLAI
Details
A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoSetupConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
Severity
4.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-4433"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-05T18:15:00Z",
"severity": "MODERATE"
},
"details": "A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoSetupConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.",
"id": "GHSA-4ppf-rv9c-6qjq",
"modified": "2023-01-12T00:30:19Z",
"published": "2023-01-05T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4433"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-103709"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4PPR-X3RG-CCJ6
Vulnerability from github – Published: 2023-08-08 12:30 – Updated: 2024-04-04 06:37
VLAI
Details
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2023-21625"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-08T10:15:13Z",
"severity": "HIGH"
},
"details": "Information disclosure in Network Services due to buffer over-read while the device receives DNS response.",
"id": "GHSA-4ppr-x3rg-ccj6",
"modified": "2024-04-04T06:37:57Z",
"published": "2023-08-08T12:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21625"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/august-2023-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-4Q33-WJ3R-P79Q
Vulnerability from github – Published: 2024-01-02 06:30 – Updated: 2024-01-02 06:30
VLAI
Details
Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-43512"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-02T06:15:13Z",
"severity": "HIGH"
},
"details": "Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.",
"id": "GHSA-4q33-wj3r-p79q",
"modified": "2024-01-02T06:30:31Z",
"published": "2024-01-02T06:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43512"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4Q5Q-CFPQ-3H3J
Vulnerability from github – Published: 2025-04-07 12:33 – Updated: 2025-04-07 12:33
VLAI
Details
Transient DOS may occur while parsing extended IE in beacon.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-21435"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-07T11:15:51Z",
"severity": "HIGH"
},
"details": "Transient DOS may occur while parsing extended IE in beacon.",
"id": "GHSA-4q5q-cfpq-3h3j",
"modified": "2025-04-07T12:33:18Z",
"published": "2025-04-07T12:33:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21435"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4RMV-M7CX-WVG4
Vulnerability from github – Published: 2025-04-07 12:33 – Updated: 2025-04-07 12:33
VLAI
Details
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-21428"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-07T11:15:50Z",
"severity": "HIGH"
},
"details": "Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.",
"id": "GHSA-4rmv-m7cx-wvg4",
"modified": "2025-04-07T12:33:18Z",
"published": "2025-04-07T12:33:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21428"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4RWX-9HRF-JJ43
Vulnerability from github – Published: 2026-09-10 21:31 – Updated: 2026-09-10 21:31
VLAI
Details
A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials.
Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-76653"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-10T21:17:45Z",
"severity": "MODERATE"
},
"details": "A missing\nauthentication vulnerability in the VPN configuration management has been\nidentified\u00a0in Archer MR600 (v2, v3 \u0026 v5) and TL-MR6400 v8\u00a0due to improper access control; a remote unauthenticated attacker\nmay be able to access and modify VPN configuration information without valid\ncredentials.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow a remote unauthenticated attacker to disclose and modify\nVPN configuration information.",
"id": "GHSA-4rwx-9hrf-jj43",
"modified": "2026-09-10T21:31:38Z",
"published": "2026-09-10T21:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76653"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/us/support/faq/5292"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4VV2-435C-33CH
Vulnerability from github – Published: 2023-10-03 06:30 – Updated: 2024-04-04 08:02
VLAI
Details
Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2023-22385"
],
"database_specific": {
"cwe_ids": [
"CWE-126",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-03T06:15:21Z",
"severity": "CRITICAL"
},
"details": "Memory Corruption in Data Modem while making a MO call or MT VOLTE call.",
"id": "GHSA-4vv2-435c-33ch",
"modified": "2024-04-04T08:02:16Z",
"published": "2023-10-03T06:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22385"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/october-2023-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-4X46-H598-64QR
Vulnerability from github – Published: 2026-06-30 15:30 – Updated: 2026-09-10 18:31
VLAI
Details
A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-58013"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-30T13:19:17Z",
"severity": "MODERATE"
},
"details": "A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.",
"id": "GHSA-4x46-h598-64qr",
"modified": "2026-09-10T18:31:20Z",
"published": "2026-06-30T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58013"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3925"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492248"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-58013"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:66018"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:65773"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:65771"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:65770"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:65769"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:65768"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:65767"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:65763"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:65762"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:63140"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:63138"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:63135"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:61783"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:61766"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:58981"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:57015"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55440"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:49512"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-5292-QC6P-VF38
Vulnerability from github – Published: 2026-06-25 15:31 – Updated: 2026-06-25 15:31
VLAI
Details
An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.
Severity
4.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-40210"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T13:16:39Z",
"severity": "MODERATE"
},
"details": "An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.",
"id": "GHSA-5292-qc6p-vf38",
"modified": "2026-06-25T15:31:59Z",
"published": "2026-06-25T15:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40210"
},
{
"type": "WEB",
"url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-54QP-W9CP-G8G3
Vulnerability from github – Published: 2025-04-03 15:31 – Updated: 2026-06-26 00:31
VLAI
Details
A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-32053"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-03T14:15:44Z",
"severity": "MODERATE"
},
"details": "A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.",
"id": "GHSA-54qp-w9cp-g8g3",
"modified": "2026-06-26T00:31:59Z",
"published": "2025-04-03T15:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32053"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4440"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4508"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4560"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4568"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7436"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:8292"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-32053"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357070"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/426"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00036.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.