Common Weakness Enumeration
CWE-126
AllowedBuffer Over-read
Abstraction: Variant · Status: Draft
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
954 vulnerabilities reference this CWE, most recent first.
GHSA-P8R2-H85Q-CMCR
Vulnerability from github – Published: 2025-02-13 18:32 – Updated: 2025-02-13 18:32
VLAI
Details
A CWE-126 “Buffer Over-read” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The information disclosure can be triggered by leveraging a memory leak affecting the web server. A remote unauthenticated attacker can exploit this vulnerability in order to leak valid authentication tokens from the process memory associated to users currently logged to the system and bypass the authentication mechanism.
Severity
7.6 (High)
{
"affected": [],
"aliases": [
"CVE-2024-12011"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-13T16:15:43Z",
"severity": "HIGH"
},
"details": "A CWE-126 \u201cBuffer Over-read\u201d was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The information disclosure can be triggered by leveraging a memory leak affecting the web server. A remote unauthenticated attacker can exploit this vulnerability in order to leak valid authentication tokens from the process memory associated to users currently logged to the system and bypass the authentication mechanism.",
"id": "GHSA-p8r2-h85q-cmcr",
"modified": "2025-02-13T18:32:33Z",
"published": "2025-02-13T18:32:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12011"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-12011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PCG2-VHM9-HHQC
Vulnerability from github – Published: 2022-05-11 00:01 – Updated: 2022-05-17 00:01
VLAI
Details
Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-1629"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-10T14:15:00Z",
"severity": "HIGH"
},
"details": "Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution",
"id": "GHSA-pcg2-vhm9-hhqc",
"modified": "2022-05-17T00:01:25Z",
"published": "2022-05-11T00:01:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1629"
},
{
"type": "WEB",
"url": "https://github.com/vim/vim/commit/53a70289c2712808e6d4e88927e03cac01b470dd"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/e26d08d4-1886-41f0-9af4-f3e1bf3d52ee"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HIP7KG7TVS5YF3QREAY2GOGUT3YUBZAI"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-32"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202305-16"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT213488"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Oct/28"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Oct/41"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PFR5-Q6HV-M7F4
Vulnerability from github – Published: 2023-01-05 18:30 – Updated: 2023-01-12 00:30
VLAI
Details
A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
Severity
4.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-4432"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-05T18:15:00Z",
"severity": "MODERATE"
},
"details": "A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.",
"id": "GHSA-pfr5-q6hv-m7f4",
"modified": "2023-01-12T00:30:19Z",
"published": "2023-01-05T18:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4432"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-103709"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PFR9-2P92-QRHQ
Vulnerability from github – Published: 2024-10-09 14:34 – Updated: 2026-05-20 00:56
VLAI
Summary
Databento Binary Encoding (DBN) has a heap buffer overflow using c_chars_to_str function
Details
The heap-buffer-overflow is triggered in the strlen() function when handling the c_chars_to_str function in the dbn crate. This vulnerability occurs because the CStr::from_ptr() function in Rust assumes that the provided C string is null-terminated. However, there is no guarantee that the input chars array passed to the c_chars_to_str function is properly null-terminated.
If the chars array does not contain a null byte (\0), strlen() will continue to read beyond the bounds of the buffer in search of a null terminator. This results in an out-of-bounds memory read and can lead to a heap-buffer-overflow, potentially causing memory corruption or exposing sensitive information.
Severity
5.5 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.22.0"
},
"package": {
"ecosystem": "crates.io",
"name": "dbn"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-09T14:34:24Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "The `heap-buffer-overflow` is triggered in the `strlen()` function when handling the `c_chars_to_str` function in the dbn crate. This vulnerability occurs because the `CStr::from_ptr()` function in Rust assumes that the provided C string is null-terminated. However, there is no guarantee that the input chars array passed to the c_chars_to_str function is properly null-terminated.\n\nIf the chars array does not contain a null byte (\\0), strlen() will continue to read beyond the bounds of the buffer in search of a null terminator. This results in an out-of-bounds memory read and can lead to a heap-buffer-overflow, potentially causing memory corruption or exposing sensitive information.",
"id": "GHSA-pfr9-2p92-qrhq",
"modified": "2026-05-20T00:56:56Z",
"published": "2024-10-09T14:34:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/databento/dbn/issues/67"
},
{
"type": "WEB",
"url": "https://github.com/databento/dbn/commit/339efb90fdb980920a5e8829008abc1114f4bfdd"
},
{
"type": "PACKAGE",
"url": "https://github.com/databento/dbn"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0377.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Databento Binary Encoding (DBN) has a heap buffer overflow using c_chars_to_str function"
}
GHSA-PGCR-3MV5-2297
Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2024-07-01 15:32
VLAI
Details
Information disclosure while handling SA query action frame.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-21458"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-01T15:15:13Z",
"severity": "MODERATE"
},
"details": "Information disclosure while handling SA query action frame.",
"id": "GHSA-pgcr-3mv5-2297",
"modified": "2024-07-01T15:32:42Z",
"published": "2024-07-01T15:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21458"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PGGH-8R27-X766
Vulnerability from github – Published: 2023-06-06 09:30 – Updated: 2024-04-04 04:34
VLAI
Details
Transient DOS in WLAN Firmware while processing frames with missing header fields.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-21659"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-06T08:15:12Z",
"severity": "HIGH"
},
"details": "Transient DOS in WLAN Firmware while processing frames with missing header fields.",
"id": "GHSA-pggh-8r27-x766",
"modified": "2024-04-04T04:34:47Z",
"published": "2023-06-06T09:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21659"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/june-2023-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PJ8H-CMGW-7XPG
Vulnerability from github – Published: 2023-12-05 03:30 – Updated: 2023-12-05 03:30
VLAI
Details
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-33081"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-05T03:15:12Z",
"severity": "HIGH"
},
"details": "Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.",
"id": "GHSA-pj8h-cmgw-7xpg",
"modified": "2023-12-05T03:30:22Z",
"published": "2023-12-05T03:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33081"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PM69-RQJ8-F5FQ
Vulnerability from github – Published: 2025-05-07 18:30 – Updated: 2025-05-07 18:30
VLAI
Details
ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-11596"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-21T11:15:33Z",
"severity": "MODERATE"
},
"details": "ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file",
"id": "GHSA-pm69-rqj8-f5fq",
"modified": "2025-05-07T18:30:41Z",
"published": "2025-05-07T18:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11596"
},
{
"type": "WEB",
"url": "https://gitlab.com/wireshark/wireshark/-/issues/20214"
},
{
"type": "WEB",
"url": "https://www.wireshark.org/security/wnpa-sec-2024-15.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PMCM-GW2W-HPXF
Vulnerability from github – Published: 2026-08-13 15:34 – Updated: 2026-08-13 15:34
VLAI
Details
A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-65933"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T15:19:56Z",
"severity": "MODERATE"
},
"details": "A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below.",
"id": "GHSA-pmcm-gw2w-hpxf",
"modified": "2026-08-13T15:34:43Z",
"published": "2026-08-13T15:34:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65933"
},
{
"type": "WEB",
"url": "https://arxiv.org/pdf/2409.02905"
},
{
"type": "WEB",
"url": "https://community.silabs.com/068Vm00000x0Yqy"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PP2Q-FPVV-VR5H
Vulnerability from github – Published: 2026-07-08 18:31 – Updated: 2026-07-08 18:31
VLAI
Details
An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-50813"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-08T18:16:32Z",
"severity": "MODERATE"
},
"details": "An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path",
"id": "GHSA-pp2q-fpvv-vr5h",
"modified": "2026-07-08T18:31:38Z",
"published": "2026-07-08T18:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50813"
},
{
"type": "WEB",
"url": "https://github.com/sqlite/sqlite/commit/c597ed79d1bd03f57198d10d1f431adda293cf2e"
},
{
"type": "WEB",
"url": "https://gist.github.com/junius-sec/f8acb66bafb80134c8e1a1c8c7c9f4f4"
},
{
"type": "WEB",
"url": "https://sqlite.org/src/info/869a51ae84df"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.