By weakness (CWE)

CWE-119: related vulnerabilities

CVEs classified under CWE-119. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

141 published vulnerabilities · page 2 of 2

• CVE-2026-13588MEDIUM 5.6

  PcapPlusPlus, a packet processing library version 25.05, contains a vulnerability in its TLS handshake processing that allows an attacker to cause a heap-based buffer overflow by manipulating the handshake version parameter. While the vulnerability is accessible over the network, exploiting it requires significant technical effort and specific conditions. The flaw could potentially allow an attacker to read sensitive memory, modify data, or disrupt application availability, though practical exploitation remains constrained by the high complexity barrier.

• CVE-2026-13589MEDIUM 5.6

  PcapPlusPlus version 25.05 contains a heap buffer overflow vulnerability in its Telnet packet parsing logic. When processing specially crafted Telnet subnegotiation commands, the vulnerable code can write beyond allocated memory boundaries. While remote exploitation is possible without authentication, the attack requires careful crafting and succeeds only under specific conditions, making opportunistic attacks less likely. A public exploit exists, increasing practical risk.

• CVE-2026-13590MEDIUM 5.6

  A heap-based buffer overflow vulnerability has been identified in seladb PcapPlusPlus version 25.05, specifically within the Modbus Protocol Handler component. When a specially crafted packet with a manipulated length argument is processed by the pcpp::ModbusLayer::getLength function, it can cause a buffer overflow in heap memory. An unauthenticated attacker on the network can trigger this condition, though significant technical knowledge and specific packet construction are required to exploit it successfully. The vulnerability enables attackers to leak sensitive memory contents, corrupt data, or potentially crash the application.

• CVE-2026-11516MEDIUM 5.5

  A buffer overflow vulnerability exists in UTT HiPER 2610G network devices through version 3.0.0-171107. An authenticated local attacker can send specially crafted input to the device's web interface to overflow a buffer and potentially read sensitive data, modify settings, or crash the device. The vulnerability resides in the NAT Static Map configuration feature and leverages improper bounds checking on the NatBinds parameter. Exploit code has been disclosed publicly.

• CVE-2026-14607MEDIUM 5.5

  CVE-2026-14607 is a memory corruption vulnerability affecting RT-Thread versions up to 5.0.2. The flaw exists in the sys_getaddrinfo function and can be triggered by manipulating the ai_addr argument during local system calls. An attacker with local access can crash the system or trigger undefined behavior through memory corruption. Exploit code has been publicly released, increasing the practical risk despite the medium CVSS score.

• CVE-2026-36910MEDIUM 5.5

  MPC-BE, a media player application, contains a flaw in how it reads MP4 video files. An attacker can craft a specially designed MP4 file that triggers an access violation when the player tries to read it, causing the application to crash. This is a local attack that requires a user to open the malicious file, but once they do, the player becomes unavailable until restarted.

• CVE-2026-12330MEDIUM 5.4

  A boundary condition error in Mozilla Firefox and Thunderbird's internationalization component can allow an attacker to read small amounts of user data or modify content on a webpage, provided the user interacts with a malicious site. The vulnerability requires user action (clicking, submitting forms) to trigger, and does not enable system-level compromise or denial of service. Mozilla has released security updates across multiple Firefox ESR branches and Thunderbird to address this flaw.

• CVE-2025-15666MEDIUM 5.3

  Open Asset Import Library (Assimp) versions up to 5.4.3 contain a heap buffer overflow vulnerability in the model file handler's scene combining function. An attacker with local system access can manipulate image dimension parameters (width/height) to trigger memory corruption. The vulnerability requires local access and user-level privileges to exploit, making it primarily a concern in environments where untrusted users can execute code or submit malicious 3D model files to applications using Assimp.

• CVE-2026-10200MEDIUM 5.3

  Assimp, a popular open-source 3D model import library, contains a heap-based buffer overflow vulnerability in its glTF file format parser. An attacker with local access to a system can craft a malicious glTF file with a specially crafted 4x4 matrix to overflow memory and trigger a crash, information disclosure, or potential code execution. The vulnerability affects Assimp versions up to 6.0.4 and has been publicly disclosed.

• CVE-2026-10229MEDIUM 5.3

  Assimp, a widely-used 3D model import library, contains a heap-based buffer overflow in its Half-Life 1 MDL file loader. An attacker with local system access can craft a malicious .MDL file that, when processed by an application using vulnerable Assimp versions up to 6.0.4, triggers memory corruption. This could lead to information disclosure, data corruption, or process crash. The vulnerability requires local execution and has been publicly disclosed.

• CVE-2026-10230MEDIUM 5.3

  Assimp, a popular open-source 3D model import library, contains a heap buffer overflow vulnerability in its Half-Life 1 MDL file loader. The vulnerability exists in the animation-reading function and can be triggered by a malicious or crafted MDL file. An attacker with local access can exploit this to read sensitive memory, modify data, or crash the application. The vulnerability affects Assimp versions up to 6.0.4.

• CVE-2026-10231MEDIUM 5.3

  Assimp, a popular open-source 3D model importing library, contains a heap buffer overflow vulnerability in its Half-Life 1 MDL file loader. By crafting a malicious MDL file that manipulates the animation value counter, an attacker with local system access can trigger memory corruption. This flaw requires the attacker to be already present on the system and execute code that processes a specially crafted model file, making it a local-origin threat rather than a remote network attack.

• CVE-2026-10232MEDIUM 5.3

  CVE-2026-10232 is a use-after-free vulnerability in Assimp, an open-source 3D model import library, affecting versions up to 6.0.4. The flaw exists in the ASE file parser component and can be triggered by a local attacker with user-level privileges when processing specially crafted ASE (ASCII Scene Export) files. Exploitation could allow an attacker to read sensitive data, modify application state, or crash the process. Because exploitation requires local access and user permissions, the risk is primarily relevant in multi-user systems or scenarios where untrusted ASE files are processed by privileged applications.

• CVE-2026-12216MEDIUM 5.3

  CVE-2026-12216 is a memory corruption flaw in Duktape, a lightweight JavaScript engine, affecting versions up to 2.99.99. An attacker with local access can manipulate function arguments in the bytecode processing component to corrupt memory, potentially leading to crashes or code execution. The vulnerability has been publicly disclosed with proof-of-concept code available, though the vendor has not acknowledged or released a patch.

• CVE-2026-12300MEDIUM 5.3

  Mozilla has patched a memory safety vulnerability affecting Firefox and Thunderbird that could allow an attacker to read sensitive data from affected systems. The flaw exists in how these applications handle memory, and while exploitation requires network access, it does not need user interaction or elevated privileges. The vulnerability is classified as Medium severity and has been resolved in Firefox 152 and Thunderbird 152.

• CVE-2026-12301MEDIUM 5.3

  A memory safety vulnerability has been identified in Firefox and Thunderbird that could allow an attacker to read sensitive information from a user's system. The flaw stems from improper memory handling and has been resolved in Firefox 152 and Thunderbird 152. While the vulnerability requires a network connection to exploit and does not enable code execution or system crashes, it does pose a confidentiality risk. Mozilla has addressed this issue and users should update to the patched versions.

• CVE-2026-12306MEDIUM 5.3

  A memory safety vulnerability was discovered in Firefox and Thunderbird that could allow attackers to read sensitive information from affected systems. The flaw affects the way these applications handle memory, creating a situation where an attacker could potentially access data they shouldn't be able to reach. Mozilla has addressed this issue in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

• CVE-2026-12307MEDIUM 5.3

  A memory safety vulnerability was discovered in Mozilla Firefox and Thunderbird that could allow an attacker to read limited sensitive data from affected systems. The flaw does not enable code execution or system disruption, but it does create a confidentiality risk. Mozilla has addressed this issue in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

• CVE-2026-12308MEDIUM 5.3

  CVE-2026-12308 is a memory safety vulnerability discovered in Mozilla Firefox and Thunderbird. The flaw allows an attacker on the network to read sensitive information from affected systems without requiring user interaction or special privileges. Mozilla has released patched versions that eliminate the underlying memory handling defect. While the vulnerability does not enable unauthorized modifications or system unavailability, the confidentiality impact warrants timely remediation, particularly for users handling sensitive data.

• CVE-2026-12329MEDIUM 5.3

  A memory safety defect affecting Mozilla Firefox and Thunderbird could allow an unauthenticated attacker to cause the application to crash or become unavailable. The vulnerability requires no user interaction and can be triggered remotely over a network. It does not enable data theft or system compromise, but denial-of-service impact is possible.

• CVE-2026-14610MEDIUM 5.3

  Assimp, a widely-used 3D model import library, contains a heap-based buffer overflow flaw in its CSM file handler that allows a local attacker with basic user privileges to corrupt memory and potentially crash the application or cause information disclosure. The vulnerability requires local access and does not grant remote execution, but public exploit code now exists, elevating practical risk.

• CVE-2026-15182MEDIUM 5.3

  GNU LibreDWG versions up to 0.13.4 contain a heap-based buffer overflow vulnerability in the BMP image handling code. An attacker with local access can exploit this flaw to read, modify, or crash sensitive data by manipulating how the application processes BMP files. Upgrading to version 0.14 resolves the issue.

• CVE-2026-10275MEDIUM 5.0

  A buffer overflow vulnerability exists in OpenSC versions up to 0.26.1 within the pkcs11-tool component's key generation functionality. The flaw allows an attacker to overflow a buffer during certificate writing operations, potentially enabling remote code execution or data corruption. Exploitation requires user interaction and specific conditions, making it moderately difficult to weaponize, though a proof-of-concept has already been disclosed.

• CVE-2026-11623MEDIUM 4.5

  A use-after-free memory vulnerability exists in tmux versions up to 3.6a, specifically within the image handling code. An attacker with local system access could trigger this flaw through a complex exploitation chain to read, modify, or crash tmux processes. While a public exploit has been disclosed, the attack requires both local access and deliberate manipulation, making opportunistic exploitation unlikely. The issue is resolved by upgrading to version 3.7-rc or applying the specific patch commit fc6d94a9f8a593bd8b7031650802084385d4ee03.

• CVE-2026-10114MEDIUM 4.3

  Open5GS versions up to 2.7.7 contain a flaw in how they parse shared NF profile information. When processing certain malformed input, the application writes data beyond the intended memory boundary, potentially crashing the service. While an attacker must have valid network credentials to exploit this, the vulnerability has been publicly disclosed, increasing the likelihood it will be weaponized.

• CVE-2026-13522MEDIUM 4.3

  Investintech SlimPDFReader versions up to 2.0.14 contain a memory access vulnerability in its PDF file handling component. An attacker can craft a malicious PDF that, when opened by a user, causes the application to read memory outside its intended boundaries. This out-of-bounds read can crash the application or potentially leak sensitive information. The vulnerability requires user interaction (opening a file) and can be delivered remotely via email or a compromised website. Notably, SlimPDFReader is no longer maintained by the vendor, meaning no official patches will be released.

• CVE-2026-14647MEDIUM 4.3

  A flaw in ONNX Runtime versions up to 1.21.x allows an authenticated attacker to read memory beyond intended boundaries when processing certain neural network model operations. An attacker with login credentials can send a specially crafted model file to trigger an out-of-bounds read, potentially exposing sensitive data. The vulnerability resides in shape inference logic for pooling operations and can be exploited remotely without user interaction.

• CVE-2026-13587LOW 3.7

  A heap-based buffer overflow vulnerability exists in PcapPlusPlus version 25.05, specifically in the LightPcapNg parser component. An attacker can manipulate a packet length parameter during parsing to trigger memory corruption on systems processing crafted pcapng files. While exploits are publicly available, the attack requires significant complexity and special conditions to execute successfully. The vulnerability carries a low CVSS severity rating due to limited direct impact potential.

• CVE-2025-15667LOW 3.3

  GPAC, a popular multimedia framework used for MP4 file processing, contains a double-free memory vulnerability in its MP4Box component. The flaw exists in the `gf_isom_nalu_sample_rewrite` function and can be triggered by manipulating a specific argument (`nalu_out_bs`). An attacker with local access can craft a malicious MP4 file that, when processed by GPAC, causes the application to free the same memory region twice, potentially crashing the process. The vulnerability has been publicly disclosed, and a patch is available.

• CVE-2025-15668LOW 3.3

  GPAC, an open-source multimedia framework widely used for MP4 processing and streaming, contains a heap-based buffer overflow vulnerability in its MP4Box component. The flaw resides in the sgpd_del_entry function, which fails to properly validate the data argument before using it in memory operations. An attacker with local access to a system running a vulnerable version of GPAC can trigger this overflow by providing malformed input to the MP4Box tool, potentially causing the application to crash or, in specific configurations, execute arbitrary code. A patch has been publicly released, and exploit code is known to exist in the wild.

• CVE-2026-10233LOW 3.3

  Assimp, a popular open-source 3D model importing library, contains an out-of-bounds read vulnerability in its Half-Life 1 MDL file loader. When processing specially crafted MDL files, the vulnerability allows an attacker with local access to read memory outside intended boundaries. While the issue has been publicly disclosed, the impact is limited to information disclosure with no ability to modify or crash systems. This vulnerability requires local file system access and authenticated user privileges to trigger.

• CVE-2026-10267LOW 3.3

  A flaw in the Janet programming language (version 1.41.0 and earlier) allows a local user to read memory beyond intended boundaries in the debug frame handling code. The vulnerability requires local system access and valid user credentials to exploit, but poses a confidentiality risk by enabling unauthorized disclosure of sensitive data in memory.

• CVE-2026-10528LOW 3.3

  Orthanc DICOM Server versions up to 1.12.11 contain a stack-based buffer overflow vulnerability in the DCMTK parser component. The flaw exists in the DcmItem::read function and can be triggered through malicious DICOM file manipulation. An attacker with local system access can exploit this to cause a denial of service condition. The vulnerability has been publicly disclosed with working exploit code available.

• CVE-2026-13573LOW 3.3

  A stack-based buffer overflow vulnerability has been reported in LLVM's StringMap insertion function within the ValueSymbolTable module. The issue affects LLVM versions up to 22.1.6 and requires local access to exploit. Notably, the LLVM project has stated this behavior falls outside their documented security scope and is not considered a security vulnerability by the maintainers. Exploit code has been publicly disclosed, though verification of the vulnerability's actual exploitability remains uncertain.

• CVE-2026-13574LOW 3.3

  CVE-2026-13574 affects LLVM versions up to 22.1.6 and involves a heap-based buffer overflow in the bitcode file handler component. A local attacker with user-level privileges could trigger a denial of service condition by manipulating the GCRelocateInst::getBasePtr function. Notably, the LLVM project has disputed the security classification of this issue, stating that the reported behavior falls outside its documented security scope. Despite public disclosure, exploitation requires local access and does not compromise confidentiality or integrity.

• CVE-2026-14759LOW 3.3

  A heap-based buffer overflow vulnerability exists in radare2, a popular reverse-engineering framework, affecting versions up to 6.1.6. The flaw is in the Java class file parser's line number table handler and can be triggered through a specially crafted Java binary. An attacker with local system access can exploit this to crash the application or potentially execute code. Public exploit code is available, elevating operational risk for users who process untrusted Java artifacts.

• CVE-2026-14760LOW 3.3

  A use-after-free vulnerability has been discovered in radare2, a popular reverse-engineering framework. The flaw exists in the regprofile handler component and can be triggered by local attackers with low privileges, leading to an application crash or potential memory corruption. While a patch has been released, the vulnerability is not currently listed as exploited in the wild by known ransomware groups or government-backed actors.

• CVE-2026-14788LOW 3.3

  A use-after-free vulnerability exists in Radare2, a widely-used reverse engineering and binary analysis framework. The flaw is located in the binary loading function and can be triggered by a local attacker with basic user privileges. While the vulnerability has been publicly disclosed, its low severity rating reflects limited direct impact—the primary consequence is denial of service through application crash. Organizations using Radare2 in production or security workflows should apply the available patch, particularly if the tool processes untrusted binaries.

• CVE-2026-14789LOW 3.3

  A stack-based buffer overflow vulnerability exists in radare2's Memory64ListStream Parser component, which processes memory dump files. An attacker with local access can manipulate a specially crafted input file to trigger a buffer overflow, potentially causing the application to crash. This is a localized denial-of-service issue affecting radare2 versions up to 6.1.6.

• CVE-2026-15185LOW 3.3

  GPAC version 26.03-DEV contains a flaw in how it processes subtitle index files (vobsub format) through its MP4Box tool. An attacker with local access can manipulate specific data in these files to trigger the software to read beyond allocated memory boundaries. This out-of-bounds read could crash the application or potentially leak sensitive data from memory. The vulnerability is of low severity due to its local-only nature and limited impact surface, though the public disclosure means exploit code may be available.

• CVE-2026-15194LOW 3.3

  Open5GS version 2.7.7 contains a use-after-free vulnerability in the AMF (Access and Mobility Management Function) component's context cleanup routine. An authenticated local attacker can trigger this flaw by manipulating the amf_context_final function, potentially leading to information disclosure. While the vulnerability requires local access and low privileges, public exploit code now exists, increasing practical risk despite the low CVSS rating.