By weakness (CWE)

CWE-122: related vulnerabilities

CVEs classified under CWE-122. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

141 published vulnerabilities · page 2 of 2

• CVE-2026-12725MEDIUM 5.9

  A flaw in dnsmasq allows a remote attacker to crash the DNS service by sending specially crafted DNS responses. The vulnerability only triggers when two features are active together: DNSSEC validation (which verifies DNS record authenticity) and query logging (which records DNS requests and responses). When these conditions are met, responses containing unsupported algorithm types cause dnsmasq to overflow an internal memory buffer, terminating the process. This results in denial of service—your DNS resolution stops working until the service is restarted.

• CVE-2026-48994MEDIUM 5.9

  ImageMagick, widely used for image processing across web services and automation workflows, contains a flaw in how it handles MAT image files on 32-bit systems. When processing certain MAT files, the software fails to properly validate a function's return value, allowing an attacker to write data past the intended memory boundary. This heap buffer overwrite can crash the application or potentially allow code execution, though the latter is not guaranteed due to the attack complexity required.

• CVE-2026-58471MEDIUM 5.9

  GNU Wget, a widely-used command-line download utility, contains a heap buffer overflow vulnerability in how it processes filenames from remote servers when character set conversion is needed. An attacker controlling a web or FTP server could craft a malicious filename that causes Wget to write beyond allocated memory boundaries, potentially crashing the application or corrupting memory. The vulnerability requires specific conditions: the filename must need character conversion, and user interaction is typically involved (such as accepting a download prompt). The issue was introduced in the filename conversion logic and has been patched in the project's main development branch.

• CVE-2026-13976MEDIUM 5.8

  A flaw in how Google Chrome handles data validation within its storage system creates a pathway for attackers who have already compromised the browser's renderer process to potentially break out of Chrome's security sandbox. The vulnerability requires an attacker to serve a specially crafted HTML page and relies on user interaction, making it a multi-step attack rather than something triggering automatically. Chrome versions before 150.0.7871.47 are vulnerable.

• CVE-2026-13588MEDIUM 5.6

  PcapPlusPlus, a packet processing library version 25.05, contains a vulnerability in its TLS handshake processing that allows an attacker to cause a heap-based buffer overflow by manipulating the handshake version parameter. While the vulnerability is accessible over the network, exploiting it requires significant technical effort and specific conditions. The flaw could potentially allow an attacker to read sensitive memory, modify data, or disrupt application availability, though practical exploitation remains constrained by the high complexity barrier.

• CVE-2026-13589MEDIUM 5.6

  PcapPlusPlus version 25.05 contains a heap buffer overflow vulnerability in its Telnet packet parsing logic. When processing specially crafted Telnet subnegotiation commands, the vulnerable code can write beyond allocated memory boundaries. While remote exploitation is possible without authentication, the attack requires careful crafting and succeeds only under specific conditions, making opportunistic attacks less likely. A public exploit exists, increasing practical risk.

• CVE-2026-13590MEDIUM 5.6

  A heap-based buffer overflow vulnerability has been identified in seladb PcapPlusPlus version 25.05, specifically within the Modbus Protocol Handler component. When a specially crafted packet with a manipulated length argument is processed by the pcpp::ModbusLayer::getLength function, it can cause a buffer overflow in heap memory. An unauthenticated attacker on the network can trigger this condition, though significant technical knowledge and specific packet construction are required to exploit it successfully. The vulnerability enables attackers to leak sensitive memory contents, corrupt data, or potentially crash the application.

• CVE-2026-14355MEDIUM 5.6

  PHP versions before specific patch levels contain a flaw in how they allocate memory for AES key-wrap-with-padding operations within the OpenSSL extension. When processing encrypted keys, the application reserves too little memory for the output, allowing OpenSSL to write beyond these bounds. This corrupts internal heap structures and causes the application to crash. The vulnerability requires specific conditions to trigger—it is not a remote code execution—but does enable a network attacker to cause denial of service on affected systems.

• CVE-2025-55645MEDIUM 5.5

  CVE-2025-55645 is a memory safety issue in GPAC MP4Box v2.4 that can be triggered by opening a specially crafted MP4 file. The vulnerability exists in code that handles digital rights management (DRM) protection information within MP4 containers. An attacker who creates a malicious MP4 file can cause the application to crash, denying service to legitimate users. The vulnerability requires local file system access and user interaction to trigger—an attacker cannot exploit it remotely over the network.

• CVE-2025-55648MEDIUM 5.5

  GPAC's MP4Box version 2.4 contains a memory handling defect that can be triggered by opening a specially crafted MP4 media file. The vulnerability allows an attacker to crash the application, disrupting work for anyone using the tool to process or analyze video files. An attacker would need local access or the ability to deliver a malicious file to a target user, but no special privileges or complex exploitation steps are required once the file is opened.

• CVE-2025-55652MEDIUM 5.5

  A memory corruption vulnerability exists in GPAC MP4Box version 2.4 that can be triggered by opening a specially crafted MP4 media file. The flaw is in code responsible for handling video codec configuration data, and exploiting it causes the application to crash, resulting in a denial of service. An attacker would need to trick a user into opening a malicious MP4 file locally on their system to trigger the vulnerability.

• CVE-2025-55661MEDIUM 5.5

  GPAC MP4Box version 2.4 contains a memory safety defect in its Opus audio parser that can be triggered by opening a specially crafted MP4 file. The flaw causes the application to crash, denying service to legitimate users. An attacker needs only local file access and user interaction (opening the file); no special privileges or network connectivity are required.

• CVE-2025-55664MEDIUM 5.5

  CVE-2025-55664 is a heap buffer overflow vulnerability in GPAC MP4Box version 2.4 that can be triggered when processing a specially crafted MP4 file. An attacker can exploit this by tricking a user into opening a malicious MP4 file, causing the application to crash or become unresponsive. This is a local, user-interaction-based attack that does not allow data theft or system compromise, but disrupts availability of the MP4Box tool.

• CVE-2025-60468MEDIUM 5.5

  GPAC's MP4Box multimedia processing tool contains a memory safety defect that allows local users to crash the application by processing specially crafted video files. When MP4Box handles certain malformed MPEG-2 Transport Stream or MP4 files during filter cleanup operations, it attempts to access memory that has already been freed, triggering a denial-of-service condition. The flaw requires local system access and authenticated user privileges to exploit.

• CVE-2026-15164MEDIUM 5.5

  A crash vulnerability exists in Wireshark's ciscodump utility affecting versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. The flaw can be triggered locally by an unprivileged user through user interaction, causing the application to crash and denying service to legitimate users. This is a moderate-severity issue with no code execution or data exposure risk.

• CVE-2026-15165MEDIUM 5.5

  Wireshark versions 4.6.0 through 4.6.6 contain a flaw in how they process TLS Encrypted Client Hello (ECH) data that can cause the application to crash when a user opens a maliciously crafted network capture file. This is a denial-of-service issue—an attacker cannot steal data or gain control of your system, but they can disrupt your ability to analyze network traffic. The vulnerability requires user interaction (opening a file) and only affects your local machine.

• CVE-2026-15169MEDIUM 5.5

  A vulnerability in Wireshark's UMTS FP protocol dissector can cause the application to crash when processing malformed network packets. This affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker could exploit this by crafting a specially designed UMTS packet that, when analyzed by Wireshark, triggers a denial of service condition, rendering the packet analysis tool temporarily unavailable.

• CVE-2026-15170MEDIUM 5.5

  Wireshark, the widely-used network analysis tool, contains a flaw in how it processes Z39.50 protocol traffic that can cause the application to crash. An attacker or malicious network traffic could trigger this crash, disrupting network troubleshooting and monitoring operations. This affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. The vulnerability requires local access and user interaction to exploit, limiting its attack surface.

• CVE-2026-15174MEDIUM 5.5

  Wireshark, a widely-used network packet analyzer, contains a flaw in its Catapult DCT2000 protocol dissector that can crash the application when processing malformed network packets. An attacker or malicious network traffic could trigger this crash, effectively denying service to anyone relying on Wireshark for network analysis. The vulnerability affects versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. Users outside these ranges are unaffected.

• CVE-2026-44814MEDIUM 5.5

  A flaw in Windows Desktop Window Manager (DWM) Core Library allows an authorized local user to read memory they shouldn't have access to. The vulnerability doesn't let attackers modify data or crash the system, but it does enable unauthorized disclosure of sensitive information resident in memory. This is a local-only issue—remote exploitation isn't possible—and requires the attacker to already have user-level access to the system.

• CVE-2025-15666MEDIUM 5.3

  Open Asset Import Library (Assimp) versions up to 5.4.3 contain a heap buffer overflow vulnerability in the model file handler's scene combining function. An attacker with local system access can manipulate image dimension parameters (width/height) to trigger memory corruption. The vulnerability requires local access and user-level privileges to exploit, making it primarily a concern in environments where untrusted users can execute code or submit malicious 3D model files to applications using Assimp.

• CVE-2026-10200MEDIUM 5.3

  Assimp, a popular open-source 3D model import library, contains a heap-based buffer overflow vulnerability in its glTF file format parser. An attacker with local access to a system can craft a malicious glTF file with a specially crafted 4x4 matrix to overflow memory and trigger a crash, information disclosure, or potential code execution. The vulnerability affects Assimp versions up to 6.0.4 and has been publicly disclosed.

• CVE-2026-10229MEDIUM 5.3

  Assimp, a widely-used 3D model import library, contains a heap-based buffer overflow in its Half-Life 1 MDL file loader. An attacker with local system access can craft a malicious .MDL file that, when processed by an application using vulnerable Assimp versions up to 6.0.4, triggers memory corruption. This could lead to information disclosure, data corruption, or process crash. The vulnerability requires local execution and has been publicly disclosed.

• CVE-2026-10230MEDIUM 5.3

  Assimp, a popular open-source 3D model import library, contains a heap buffer overflow vulnerability in its Half-Life 1 MDL file loader. The vulnerability exists in the animation-reading function and can be triggered by a malicious or crafted MDL file. An attacker with local access can exploit this to read sensitive memory, modify data, or crash the application. The vulnerability affects Assimp versions up to 6.0.4.

• CVE-2026-10231MEDIUM 5.3

  Assimp, a popular open-source 3D model importing library, contains a heap buffer overflow vulnerability in its Half-Life 1 MDL file loader. By crafting a malicious MDL file that manipulates the animation value counter, an attacker with local system access can trigger memory corruption. This flaw requires the attacker to be already present on the system and execute code that processes a specially crafted model file, making it a local-origin threat rather than a remote network attack.

• CVE-2026-14610MEDIUM 5.3

  Assimp, a widely-used 3D model import library, contains a heap-based buffer overflow flaw in its CSM file handler that allows a local attacker with basic user privileges to corrupt memory and potentially crash the application or cause information disclosure. The vulnerability requires local access and does not grant remote execution, but public exploit code now exists, elevating practical risk.

• CVE-2026-14940MEDIUM 5.3

  A flaw in 389 Directory Server allows an attacker to send specially crafted LDAP search requests that cause the server to write data beyond the boundaries of allocated memory. The vulnerability specifically affects how the server processes certain types of directory names (DNs) containing legacy formatting with nested attributes. An unauthenticated attacker on the network can trigger this condition without logging in, potentially crashing the directory service or corrupting its memory. This is not a weakness that grants unauthorized data access, but rather a stability issue that can disrupt service availability.

• CVE-2026-15182MEDIUM 5.3

  GNU LibreDWG versions up to 0.13.4 contain a heap-based buffer overflow vulnerability in the BMP image handling code. An attacker with local access can exploit this flaw to read, modify, or crash sensitive data by manipulating how the application processes BMP files. Upgrading to version 0.14 resolves the issue.

• CVE-2026-41981MEDIUM 5.3

  CVE-2026-41981 is a medium-severity vulnerability affecting the IPC (Inter-Process Communication) module that allows an attacker with local access to write data outside the intended memory boundaries. This out-of-bounds write can corrupt system memory and lead to service disruptions or unexpected behavior. The vulnerability requires local access and user-level privileges to exploit, reducing its immediate threat surface but still warranting timely remediation in multi-user or containerized environments.

• CVE-2026-15173MEDIUM 4.7

  Wireshark versions 4.6.0 through 4.6.6 contain a flaw in how they parse pcapng packet capture files. A malformed pcapng file can cause Wireshark to crash, denying service to users who open the file. An attacker would need to trick a user into opening a specially crafted pcapng file, but requires no special privileges and the attack leaves no data integrity or confidentiality impact—only availability is affected.

• CVE-2026-46692MEDIUM 4.1

  ImageMagick, a widely-used image manipulation tool, contains a heap buffer overwrite vulnerability in its distributed cache service. An attacker with local access to the cache service can trigger the flaw to crash the service, causing a denial of service. The vulnerability affects ImageMagick versions before 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch). While the attack requires local connectivity to the cache daemon and elevated privileges, the impact is confined to availability—not confidentiality or integrity.

• CVE-2026-15028LOW 3.9

  A security flaw in libarchive allows an attacker to cause a heap overflow by crafting a specially designed tar archive file. The vulnerability exists in how the library handles PAX extended headers, specifically a malformed SUN.holesdata attribute used for sparse files. When a victim opens such a file, it can crash the system (denial of service) or potentially allow the attacker to execute arbitrary code. However, the vulnerability requires local access and user interaction, which limits its immediate threat scope.

• CVE-2026-40528LOW 3.8

  OpenSC, a widely-used open-source library for working with smart cards and cryptographic tokens, contains a buffer overflow vulnerability in its profile configuration parser. When OpenSC's pkcs15-init tool processes a maliciously crafted configuration file, it can be tricked into copying more data than a buffer can hold, corrupting memory. An attacker would need local access to supply the malicious file and convince a user to run the initialization tool, but successful exploitation could allow memory corruption and potential code execution.

• CVE-2026-13587LOW 3.7

  A heap-based buffer overflow vulnerability exists in PcapPlusPlus version 25.05, specifically in the LightPcapNg parser component. An attacker can manipulate a packet length parameter during parsing to trigger memory corruption on systems processing crafted pcapng files. While exploits are publicly available, the attack requires significant complexity and special conditions to execute successfully. The vulnerability carries a low CVSS severity rating due to limited direct impact potential.

• CVE-2026-54696LOW 3.7

  Ruby JSON versions 2.9.0 through 2.19.8 contain a heap buffer overflow vulnerability in the JSON generator when handling streamed objects. If a JSON dump or generator operation receives a specially crafted object with an attacker-controlled string near 16 KB in size, the internal buffer can overflow, causing the application to crash. This is a denial-of-service issue that requires specific conditions to trigger but poses minimal impact to confidentiality or integrity. The vulnerability is fixed in version 2.19.9 and later.

• CVE-2026-0130LOW 3.5

  CVE-2026-0130 is a low-severity vulnerability affecting Google Android that allows an attacker to read sensitive data from device memory through a malformed network packet. The flaw exists in the RtcpChunk decoder, which fails to properly validate buffer boundaries before reading data. An attacker must trick a user into accepting or opening a specially crafted media stream or communication session to trigger the vulnerability. Successful exploitation results in disclosure of locally stored information but does not enable device compromise, privilege escalation, or data modification.

• CVE-2025-15668LOW 3.3

  GPAC, an open-source multimedia framework widely used for MP4 processing and streaming, contains a heap-based buffer overflow vulnerability in its MP4Box component. The flaw resides in the sgpd_del_entry function, which fails to properly validate the data argument before using it in memory operations. An attacker with local access to a system running a vulnerable version of GPAC can trigger this overflow by providing malformed input to the MP4Box tool, potentially causing the application to crash or, in specific configurations, execute arbitrary code. A patch has been publicly released, and exploit code is known to exist in the wild.

• CVE-2026-11792LOW 3.3

  A memory corruption flaw exists in 389 Directory Server's audit logging feature. When audit logging is enabled and certain password storage conditions are met, the server can write more data than a buffer can hold, corrupting memory and producing garbled audit logs. The vulnerability requires non-standard configuration or a compromised replication partner to trigger, which limits real-world exposure.

• CVE-2026-13574LOW 3.3

  CVE-2026-13574 affects LLVM versions up to 22.1.6 and involves a heap-based buffer overflow in the bitcode file handler component. A local attacker with user-level privileges could trigger a denial of service condition by manipulating the GCRelocateInst::getBasePtr function. Notably, the LLVM project has disputed the security classification of this issue, stating that the reported behavior falls outside its documented security scope. Despite public disclosure, exploitation requires local access and does not compromise confidentiality or integrity.

• CVE-2026-14759LOW 3.3

  A heap-based buffer overflow vulnerability exists in radare2, a popular reverse-engineering framework, affecting versions up to 6.1.6. The flaw is in the Java class file parser's line number table handler and can be triggered through a specially crafted Java binary. An attacker with local system access can exploit this to crash the application or potentially execute code. Public exploit code is available, elevating operational risk for users who process untrusted Java artifacts.

• CVE-2026-45466LOW 3.3

  A flaw in Microsoft Office Word allows an attacker to trigger a heap-based buffer overflow by crafting a malicious document. When a user opens the document, sensitive information stored in the application's memory could be read by the attacker. This is a local attack—the attacker cannot exploit it remotely—and it requires user interaction to open the malicious file. The confidentiality risk is limited; no system damage or data modification occurs.