By weakness (CWE)

CWE-125: related vulnerabilities

CVEs classified under CWE-125. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

286 published vulnerabilities · page 2 of 3

• CVE-2026-46199HIGH 7.1

  A flaw in the Linux kernel's AMD GPU video codec (VCN4) driver allows a local attacker to read memory beyond the intended boundaries of a buffer when processing decode messages. An authenticated user with local access can exploit this to access sensitive kernel memory, potentially exposing confidential data or triggering a system crash. The vulnerability requires local access and valid user privileges, limiting its reach but making it a concern for multi-user systems and containerized environments.

• CVE-2026-46203HIGH 7.1

  A flaw in the Linux kernel's Cadence QuadSPI controller driver can cause the system to access hardware registers without proper power management during driver shutdown. When the driver is unloaded, it attempts to disable the controller without ensuring the hardware is powered up first, potentially causing system instability or data corruption. This is a local issue requiring user-level access to trigger.

• CVE-2026-46204HIGH 7.1

  A bounds-checking vulnerability exists in the Linux kernel's AMD GPU video codec (VCN4) instruction buffer parser. When the kernel processes instruction buffers from user space, it can read beyond allocated memory if malicious or malformed data is provided. A local attacker with basic user privileges can trigger out-of-bounds reads, potentially exposing sensitive kernel memory or causing a denial of service. The fix involves rewriting the parser to use proper bounds-checking functions.

• CVE-2026-46230HIGH 7.1

  A boundary-checking flaw in the Linux kernel's AMD GPU video codec driver (VCN3) allows a local user with moderate privileges to read memory beyond allocated buffer boundaries when the driver processes video decoding messages. This out-of-bounds read could expose sensitive kernel memory or crash the system. The vulnerability requires local access and existing user-level permissions to trigger.

• CVE-2026-46293HIGH 7.1

  A Linux kernel vulnerability exists in the Microchip PolarFire SoC clock controller driver where the software attempts to write data to memory locations outside the bounds of an allocated array during clock output registration. Specifically, when the driver registers the last two clock outputs, it accesses array indices that were never allocated, corrupting adjacent memory. This occurs because the code defines space for two PLLs and their outputs but fails to properly offset the array indices when handling DLL (Delay-Locked Loop) outputs that the driver doesn't actually support. An attacker with local access can exploit this to read sensitive kernel memory or cause a denial of service.

• CVE-2026-47147HIGH 7.1

  CVE-2026-47147 is a memory disclosure vulnerability in Silicon Labs' EmberZNet protocol stack affecting version 9.0.2 and earlier. An attacker who has already joined a Zigbee network can send specially crafted Over-the-Air (OTA) update requests that cause the OTA server to read beyond intended memory boundaries, leaking a limited amount of RAM contents back to the requester. The vulnerability is network-bound, requires prior network authentication, and only impacts devices that implement the OTA Server cluster—significantly narrowing the exposure window compared to broader network attacks.

• CVE-2026-52719HIGH 7.1

  A flaw in GStreamer's JPEG decoder allows an attacker to craft a malicious JPEG file that, when opened, causes the application to read data outside the bounds of the file buffer. This can crash the application or potentially leak sensitive information from memory. The vulnerability requires user interaction—someone must open the specially crafted file—but requires no special privileges and spreads easily via email, messaging, or web downloads.

• CVE-2026-52917HIGH 7.1

  A race condition exists in the Linux kernel's SCTP (Stream Control Transmission Protocol) diagnostic module that allows a local attacker with low privileges to crash the system or read sensitive kernel memory. The vulnerability arises when the kernel attempts to retrieve SCTP socket diagnostic information while an association is being freed, causing it to read from memory that has already been deallocated or modified. This results in either a denial of service or potential information disclosure.

• CVE-2026-52942HIGH 7.1

  A flaw in the Linux kernel's netfilter logging subsystem allows a local attacker to read memory beyond allocated buffer boundaries. When the kernel logs network packets, it attempts to dump the MAC (media access control) header without properly verifying that the header information has been set. An attacker with local access can craft and send specially crafted packets through AF_PACKET with QDISC bypass enabled, causing the logging function to read approximately 64 KB past the intended buffer and leak that kernel memory into the system log. This information disclosure could expose sensitive kernel data to unprivileged users.

• CVE-2026-52953HIGH 7.1

  A flaw in the Linux kernel's IOMMU (Input/Output Memory Management Unit) VT-d driver can crash a system when certain device assignment operations occur, particularly when QEMU virtual machines are terminated. The issue arises from the kernel trying to access memory beyond the bounds of a special internal structure called the 'blocked domain,' causing a protection fault that halts the affected process or system. This is a memory safety issue specific to how the kernel manages I/O device permissions and virtual machine configurations.

• CVE-2026-53044HIGH 7.1

  A memory access vulnerability exists in the Linux kernel's Tegra SoC cross-bar (CBB) fabric code. The vulnerability stems from incorrect array size calculations in lookup tables used during target timeout operations. When the kernel attempts to access fabric configuration data during a timeout event, it may read memory outside the intended table boundaries. This could allow a local attacker with minimal privileges to read sensitive kernel memory or cause a system crash.

• CVE-2026-53076HIGH 7.1

  A flaw in the Linux kernel's BPF (Berkeley Packet Filter) subsystem allows an unprivileged local user to read memory beyond intended boundaries. The vulnerability arises when copying data between certain kernel map types—specifically from a CGROUP_STORAGE map into a per-CPU map when both have non-standard sizes (not aligned to 8 bytes). The kernel incorrectly assumes all source memory is rounded up to 8 bytes, causing it to read extra data it shouldn't access. This could leak sensitive kernel memory to an attacker with local access.

• CVE-2026-53138HIGH 7.1

  A flaw in the Linux kernel's AMD display driver can cause the system to loop indefinitely when processing a corrupted graphics firmware (VBIOS) image. During system startup, the driver reads firmware records to configure the display hardware. If the firmware is malformed and missing the expected end-marker, the driver keeps reading memory in 256-byte increments until it either crashes or exhausts resources. An attacker with physical access to replace the firmware, or a supply-chain compromise affecting pre-installed firmware, could trigger this condition. Local users with sufficient privilege to load modified firmware could also exploit it. The fix limits the loop to a reasonable maximum of 256 records, preventing runaway iteration.

• CVE-2026-53149HIGH 7.1

  A flaw in the Linux kernel's Thunderbolt driver allows a local user with restricted privileges to read sensitive memory or crash the system. The vulnerability exists in how the kernel validates directory structures when parsing Thunderbolt property data. When a malformed directory header claims to contain more content than the allocated memory block actually holds, the kernel fails to reject it and instead reads beyond the intended boundaries, potentially exposing kernel memory or causing a denial of service.

• CVE-2026-53179HIGH 7.1

  A buffer over-read vulnerability exists in the Linux kernel's RTL8723BS wireless driver. The rtw_update_protection() function is called with a pointer that references a specific position within a buffer, but it is passed the total length of the entire buffer rather than the remaining bytes from that position. This causes the function to read beyond the intended region of memory, potentially exposing sensitive kernel data. The flaw affects the staging driver and requires local access to trigger.

• CVE-2026-53253HIGH 7.1

  A flaw in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) handler allows a remote Bluetooth peer to trigger a memory access violation by sending malformed frames. The vulnerability stems from the kernel reading packet fields without first verifying that enough data is present in the incoming frame. When an attacker sends a truncated BNEP packet, the code attempts to access memory beyond the actual packet contents, leading to a crash or potential information disclosure. The issue affects systems with Bluetooth connectivity that process BNEP traffic.

• CVE-2026-53255HIGH 7.1

  The Linux kernel contains a flaw in how it validates Bluetooth advertising data when processing management commands. A malformed advertising request can cause the kernel to read memory beyond the bounds of the supplied data buffer. This out-of-bounds read is triggered when a length field points past the actual data, allowing an attacker with local access to crash the system or potentially leak sensitive memory contents.

• CVE-2026-53303HIGH 7.1

  A race condition exists in the Linux kernel's f2fs filesystem implementation that can occur when sysfs operations access extension list data without proper synchronization. When one process modifies the extension list while another reads it via sysfs, the reader may encounter inconsistent data—such as mismatched counts and array contents—potentially causing out-of-bounds memory access or displaying stale information. This requires local access to exploit and affects systems where untrusted local users can access sysfs interfaces.

• CVE-2026-53330HIGH 7.1

  A flaw exists in the Linux kernel's AMD display driver that allows code to read memory outside the bounds of a small array. The bug occurs when certain graphics hardware reports the maximum number of signal repeaters allowed by the DisplayPort specification. Because the array is sized one element too small, accessing data for the 8th repeater reads into adjacent memory. An attacker with local access could exploit this to leak sensitive kernel memory or trigger a system crash.

• CVE-2026-53346HIGH 7.1

  A flaw in how the Linux kernel's Rust compiler toolchain handles unwinding information for ARM64 systems can cause boot failures when certain kernel security features are enabled. Specifically, when the kernel is built with both Rust support and address sanitizer (KASAN) constructor patching enabled, compiler-generated initialization functions may be patched incorrectly, leading to a crash during system startup. The issue stems from a rustc compiler bug where the unwind table flag is not properly applied to all generated functions, only to explicitly declared ones.

• CVE-2026-53703HIGH 7.1

  GStreamer's RealMedia file parser has a buffer-reading flaw that can crash applications or leak memory contents. When a malicious or malformed RealMedia (.rm) file contains an undersized audio header, the parser reads past the end of its data buffer, potentially accessing uninitialized or sensitive memory. The vulnerability requires user interaction—someone must open a crafted file—but poses a meaningful risk to applications that automatically process media files or expose the parser to untrusted sources.

• CVE-2026-53704HIGH 7.1

  GStreamer, a popular multimedia framework, contains a vulnerability in its RealMedia file parser that can be triggered by opening a malicious .rm file. The parser fails to properly validate boundaries when reading metadata, allowing crafted files to cause the application to hang indefinitely, crash, or leak memory. An attacker simply needs to trick a user into opening a specially constructed RealMedia file—no special network access or authentication is required. The flaw affects the gst-plugins-ugly package, which is commonly installed alongside GStreamer for handling restricted multimedia formats.

• CVE-2026-56210HIGH 7.1

  A bounds-checking flaw in libaom, the reference implementation of the AV1 video codec, allows attackers to read unintended memory from the heap. An attacker who can send specially crafted video encoding parameters—particularly by setting an SVC (Scalable Video Coding) layer identifier beyond the legitimate range—can trigger the vulnerability. The result is either exposure of sensitive data resident in heap memory or a crash of the encoder process. This matters most to services that accept untrusted video input and run libaom on network-facing infrastructure.

• CVE-2026-45608MEDIUM 6.8

  A flaw in Windows DHCP Client allows a local attacker to read sensitive memory content without authentication. The vulnerability exists because the DHCP client fails to validate buffer boundaries before reading network configuration data, exposing information like cached credentials or system details to an attacker with local access. No user interaction is required, and the attacker does not need special privileges—standard user permissions are sufficient.

• CVE-2026-7764MEDIUM 6.8

  A flaw in Morse Micro's HaLow Wi-Fi kernel driver allows an attacker within radio range to crash devices or leak small amounts of sensitive memory by sending a specially crafted wireless frame. The vulnerability exists because the driver doesn't properly validate the size of data embedded in beacon or probe response frames before reading from it. No password, pairing, or user action is needed—an attacker simply has to be nearby with the right equipment.

• CVE-2025-15661MEDIUM 6.5

  libssh2 versions up to 1.11.1 contain a flaw in how they handle responses from SSH servers during SFTP file operations. A malicious or compromised SSH server can craft a specially-malformed response that causes the client library to read beyond the boundaries of its own memory buffer. This can leak sensitive data from the application's memory or cause the client to crash. The vulnerability exists in the symlink-related operations (READLINK and REALPATH) and requires network access to an SSH server, but does not require user interaction or special privileges.

• CVE-2025-70101MEDIUM 6.5

  CVE-2025-70101 is a memory safety flaw in the lwext4 library, a lightweight ext4 filesystem implementation. When processing a specially crafted ext4 disk image, the library can read past the end of allocated memory due to missing validation checks. An attacker who tricks a user into opening a malicious filesystem image can trigger this out-of-bounds read, causing the application to crash. This is primarily a denial-of-service risk rather than a gateway to data theft or system compromise.

• CVE-2026-0127MEDIUM 6.5

  A flaw in how Android processes certain network messaging has been discovered that allows an attacker with basic network access to crash the device's communication processor. The vulnerability stems from improper bounds checking when reading data from network messages, potentially causing the system to read memory beyond intended limits. An attacker can trigger this remotely without needing special privileges or user interaction, though they do require an authenticated network connection to the affected system.

• CVE-2026-0128MEDIUM 6.5

  A vulnerability in how Android processes RTCP feedback packets can allow an attacker to read sensitive memory from a device. An integer overflow in the packet decoding function causes the system to read beyond intended buffer boundaries. An attacker would need to trick a user into interacting with a malicious packet (for example, through a compromised media stream or application), but no special permissions are required for the attack itself. The vulnerability exposes information only—it cannot be used to modify data or crash the system.

• CVE-2026-0136MEDIUM 6.5

  A memory safety flaw in Android's modem component allows an attacker with valid login credentials to remotely crash a device by triggering an out-of-bounds read. The vulnerability requires network access and authentication but no additional privileges or user interaction, making it a straightforward denial of service vector for authenticated attackers.

• CVE-2026-10979MEDIUM 6.5

  A flaw in the ANGLE graphics library used by Google Chrome before version 149.0.7827.53 allows attackers to read memory outside intended bounds. An attacker can craft a malicious HTML page that, when visited by a user, extracts sensitive data from Chrome's process memory—such as authentication tokens, encryption keys, or other confidential information. Exploitation requires user interaction (clicking a link or visiting a site) but no special privileges.

• CVE-2026-10985MEDIUM 6.5

  A flaw in Skia, the graphics rendering engine used by Google Chrome, allows attackers to read data they shouldn't have access to by crafting a malicious web page. When a user visits such a page, the browser's memory can leak information from other websites or origins, potentially exposing sensitive data. The attack requires user interaction—clicking a link or visiting a hostile site—but doesn't require any special browser permissions or configuration.

• CVE-2026-10999MEDIUM 6.5

  An integer overflow vulnerability exists in ANGLE (a graphics abstraction layer) within Google Chrome on Windows. Before version 149.0.7827.53, this flaw could allow an attacker who already controls the Chrome renderer process to read sensitive data from memory by tricking a user into viewing a specially crafted webpage. The vulnerability requires user interaction (clicking a link or visiting a malicious site) but does not allow the attacker to modify data or crash the browser.

• CVE-2026-11006MEDIUM 6.5

  A memory safety flaw in Google Chrome's Dawn graphics component (used for GPU rendering) allows attackers to read sensitive data from a user's memory by tricking them into visiting a specially crafted webpage. The vulnerability does not enable code execution or system crashes, but confidentiality is at risk. Chrome versions prior to 149.0.7827.53 are affected.

• CVE-2026-11051MEDIUM 6.5

  A memory reading flaw exists in the ANGLE graphics component of Google Chrome on Linux systems prior to version 149.0.7827.53. An attacker can craft a malicious webpage that, when visited, reads data from Chrome's process memory—potentially exposing sensitive information like credentials, cryptographic keys, or other in-memory secrets. The vulnerability requires user interaction (clicking or viewing a link) but does not allow the attacker to modify data or crash the browser.

• CVE-2026-11075MEDIUM 6.5

  A flaw in Google Chrome's V8 JavaScript engine allows an attacker to read sensitive data from a browser process's memory by tricking a user into visiting a malicious webpage. The vulnerability exists in Chrome versions before 149.0.7827.53 and requires no special privileges to exploit—only user interaction to visit a crafted page. While the attacker cannot modify data or crash the browser, they can potentially extract confidential information like passwords, session tokens, or other data resident in memory.

• CVE-2026-11090MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the ANGLE graphics library that can be exploited to leak data across website boundaries. An attacker could craft a malicious webpage that, when visited, causes Chrome to inadvertently expose sensitive information from other origins a user has open. This requires user interaction (visiting the malicious page) but does not require special privileges. The vulnerability affects Windows, macOS, and Linux systems running vulnerable Chrome versions.

• CVE-2026-11096MEDIUM 6.5

  A memory reading flaw in Chrome's WebRTC component allows attackers to trick users into visiting a malicious webpage that steals sensitive data from the browser's memory. The vulnerability requires user interaction (clicking a link or visiting a site) but needs no special privileges, making it a practical attack vector for information theft. Google patched this in Chrome version 149.0.7827.53 and later.

• CVE-2026-11160MEDIUM 6.5

  Google Chrome on Linux versions before 149.0.7827.53 contains a memory reading flaw in its input handling. An attacker can trick a user into visiting a specially crafted webpage, causing Chrome to leak sensitive data from the browser process's memory—such as cached passwords, session tokens, or other confidential information. The vulnerability requires user interaction (clicking a link or visiting a site) but no special privileges, and affects only Linux systems.

• CVE-2026-11183MEDIUM 6.5

  CVE-2026-11183 is a memory safety vulnerability in Google Chrome's GWP-ASan security feature that allows an attacker with local access to read sensitive data from the browser's memory by tricking a user into opening a malicious file. While the flaw requires user interaction and doesn't allow remote code execution, it can expose confidential information such as cached credentials, session tokens, or other sensitive data held in process memory.

• CVE-2026-11299MEDIUM 6.5

  A flaw in how Google Chrome handles font data can lead to information disclosure when a user visits a malicious webpage. An attacker can craft a specially designed HTML page that exploits an integer overflow vulnerability in Chrome's font processing code, potentially allowing them to read sensitive data from the browser's memory. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction (visiting the malicious site) to trigger.

• CVE-2026-12026MEDIUM 6.5

  A memory-reading vulnerability exists in Chrome's video processing component on ChromeOS. An attacker who successfully compromises the browser's renderer process can craft a malicious web page to read sensitive information stored in the browser's memory—such as passwords, authentication tokens, or other user data—and exfiltrate it. The vulnerability requires the attacker to already control the renderer process, which limits the attack surface but remains a serious concern when combined with other browser exploits.

• CVE-2026-12461MEDIUM 6.5

  A memory reading flaw in Google Chrome's WebRTC component allows attackers to trick users into visiting a malicious webpage that extracts sensitive data from the browser's process memory. The vulnerability affects Windows users running Chrome versions prior to 149.0.7827.155. An attacker would need user interaction—specifically, the user must visit a crafted HTML page—but no special privileges or system access are required on the victim's end.

• CVE-2026-13820MEDIUM 6.5

  A flaw in Skia, Google Chrome's graphics library, allows an attacker who has already compromised Chrome's renderer process to read memory outside intended boundaries. By serving a specially crafted webpage, the attacker can extract sensitive information that crosses origin boundaries—data they should not have access to. This requires the attacker to first gain control of the renderer process, which typically happens when a user visits a malicious or compromised website. The vulnerability affects Chrome on macOS prior to version 150.0.7871.47.

• CVE-2026-13858MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a memory safety flaw in the bundled FFmpeg video decoder. When processing a specially crafted video file, the decoder reads beyond allocated memory boundaries, potentially exposing sensitive data from the browser process's memory to an attacker. The vulnerability requires user interaction—an attacker must trick a user into opening a malicious video—but exploitation is otherwise straightforward.

• CVE-2026-13873MEDIUM 6.5

  A memory reading flaw in Google Chrome's Layout component allows attackers to trick users into visiting a malicious webpage that reads sensitive data from the browser process. The attacker gains no ability to modify data or crash the system, but can potentially expose information that should remain private. This affects Chrome versions before 150.0.7871.47 across Windows, macOS, and Linux systems.

• CVE-2026-13906MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain an out-of-bounds read vulnerability in its codec handling code. An attacker can craft a malicious HTML page that, when visited by a user, reads data from Chrome's process memory and potentially exposes sensitive information. The vulnerability requires user interaction (visiting a webpage) but no special privileges, and affects confidentiality only—not availability or integrity.

• CVE-2026-14384MEDIUM 6.5

  A memory safety flaw in Chrome's graphics rendering engine (ANGLE) allows attackers to read sensitive data across security boundaries on Windows systems. By serving a specially crafted webpage, an attacker can trick a user into visiting a malicious site and leak information that should remain private—such as data from other websites the user has open. The vulnerability requires user interaction (clicking or visiting a link) but does not require the attacker to be authenticated or have special privileges.

• CVE-2026-14386MEDIUM 6.5

  A memory access vulnerability in Chrome's graphics rendering engine (ANGLE) allows attackers to read sensitive data from your browser's memory by tricking you into visiting a specially crafted webpage. The vulnerability affects Chrome versions before 150.0.7871.46 and requires user interaction—you must click or view malicious content for the attack to work. An attacker cannot execute code or crash your browser, but they could potentially steal passwords, tokens, or other sensitive information stored in memory.

• CVE-2026-14388MEDIUM 6.5

  Google Chrome versions before 150.0.7871.46 contain a memory reading vulnerability in the ANGLE graphics library. A remote attacker can exploit this by serving a specially crafted HTML page to a user. If a user visits the malicious page, the attacker may extract sensitive information—such as passwords, encryption keys, or other data—from Chrome's process memory. The vulnerability requires user interaction (clicking a link or visiting a site) but does not require any special privileges or configuration.

• CVE-2026-14396MEDIUM 6.5

  A memory safety issue in the ANGLE graphics library used by Google Chrome allows attackers to read sensitive data across website boundaries. When a user visits a malicious webpage, an attacker can craft specific HTML content that triggers an out-of-bounds memory read. This flaw enables unauthorized access to data intended for other websites—a cross-origin information disclosure. The vulnerability requires user interaction (visiting a malicious page) but does not require any special browser configuration or credentials.

• CVE-2026-28979MEDIUM 6.5

  An out-of-bounds memory access vulnerability exists in Apple's Safari browser and related Apple operating systems. When a user visits a malicious website, the flaw can crash the affected application unexpectedly. The vulnerability stems from insufficient bounds checking when processing web content, allowing an attacker to read from or write to memory locations outside intended boundaries. No data theft or system compromise occurs; the impact is limited to denial of service through application crashes.

• CVE-2026-43676MEDIUM 6.5

  An out-of-bounds memory access flaw in Apple's Safari browser and related operating systems can cause unexpected crashes when users visit websites containing malicious content. The vulnerability affects Safari on Mac, iPhone, and iPad, as well as visionOS and watchOS. While the issue results in denial of service rather than data theft or system compromise, it degrades user experience and could be chained with other exploits in targeted attacks. Apple has patched the vulnerability across its ecosystem.

• CVE-2026-43703MEDIUM 6.5

  CVE-2026-43703 is a memory handling flaw in Apple's operating systems that can cause an application to crash when processing specially crafted web content. An attacker would need to trick a user into visiting a malicious website or viewing attacker-controlled web content; the crash itself does not expose data or allow unauthorized access, but it does disrupt availability. Apple has patched this issue across iOS, iPadOS, macOS variants, tvOS, visionOS, and watchOS.

• CVE-2026-43712MEDIUM 6.5

  A memory handling flaw in Safari and related Apple platforms can cause a web browser to crash when processing specially crafted web content. An attacker would need to trick a user into visiting a malicious website, but no special access or user privileges are required beyond normal browsing. The issue affects Safari on macOS and iOS/iPadOS devices, as well as Apple TV, Vision Pro, and Watch.

• CVE-2026-43951MEDIUM 6.5

  Apache HTTP Server contains an out-of-bounds read vulnerability in the mod_headers and mod_mime modules when handling responses with multiple language variants. An unauthenticated attacker on the network can trigger this flaw to read sensitive data from server memory without requiring user interaction or special privileges. The vulnerability affects all versions from 2.4.0 through 2.4.67.

• CVE-2026-45160MEDIUM 6.5

  ESP-IDF, Espressif's development framework for IoT devices, contains a memory safety flaw in its DHCP server component. When processing DHCP requests from clients on a local network, the parser does not properly validate option lengths, allowing an attacker to craft a malicious request that causes the device to read data beyond the intended buffer boundary. This could lead to information disclosure or device instability. The issue affects devices running as DHCP servers—notably ESP32 and similar chips using ESP-IDF's SoftAP (soft access point) feature.

• CVE-2026-4526MEDIUM 6.5

  EmberZNet, Silicon Labs' Zigbee networking framework, contains a vulnerability in versions 9.0.2 and earlier that allows an already-connected network device to crash the framework by sending specially crafted global ZCL (Zigbee Cluster Library) messages. The vulnerability does not expose sensitive data and requires the attacker to already have network access—it is primarily a denial-of-service risk rather than a confidentiality or integrity threat.

• CVE-2026-45696MEDIUM 6.5

  OpenEXR, the industry-standard image format for motion pictures, contains a flaw in its HTJ2K decoder that allows a maliciously crafted EXR file to crash any application that opens it. When processing the file, the decoder incorrectly trusts the declared image dimensions without validating them against the actual data buffer, causing it to read beyond allocated memory. Any tool that previews, validates, or processes EXR files—including thumbnail generators, asset management systems, and the exrcheck utility—is at risk. This affects versions 3.4.0 through 3.4.11.

• CVE-2026-46433MEDIUM 6.5

  lldpd, a Linux daemon that implements LLDP (Link Layer Discovery Protocol), contains a heap buffer over-read flaw in its VLAN tag handling code. When processing certain network frames that match the network interface's maximum transmission unit (MTU) size, the daemon reads 4 bytes beyond an allocated memory buffer. This can disrupt the daemon's operation, though it does not directly enable code execution or data theft. The vulnerability affects versions before 1.0.22 and requires network access to trigger.

• CVE-2026-47148MEDIUM 6.5

  EmberZNet versions 9.0.2 and earlier contain a denial-of-service vulnerability triggered by malformed GetGroupMembership commands. An attacker with network access and prior device enrollment can send a specially crafted message that causes the receiving device to read past the end of its message buffer, crashing the process. The vulnerability does not leak data and only affects devices that support the Groups cluster—a subset of EmberZNet deployments.

• CVE-2026-47149MEDIUM 6.5

  EmberZNet v9.0.2 and earlier contains a flaw where specially crafted Door Lock cluster messages with invalid user identifiers can crash the affected device. An attacker must already be part of the network and send the malformed message from an authenticated device to trigger the issue. No data is leaked in the attack, but the device becomes unavailable until restarted.

• CVE-2026-47154MEDIUM 6.5

  EmberZNet versions up to 9.0.2 contain a vulnerability where specially crafted meter response messages can crash devices that support the Simple Metering cluster. The vulnerability only affects devices already connected to the network, and an attacker would need network access and authentication to send the malicious message. No data is stolen or leaked in the attack.

• CVE-2026-48112MEDIUM 6.5

  7-Zip versions 9.18 through 26.00 contain a memory safety defect in their handler for Unix ar archives—specifically when parsing BSD-style symbol tables. The flaw allows an attacker to craft a malicious ar archive that, when opened by 7-Zip, causes the parser to read 4 bytes of uninitialized heap memory beyond the intended buffer boundary. This disclosure of uninitialized data could leak sensitive information from the process memory. The vulnerability requires user interaction: a victim must open the malicious archive file. Version 26.01 resolves the issue.

• CVE-2026-49271MEDIUM 6.5

  libheif is a widely-used library for decoding and encoding HEIF and AVIF image formats. Versions before 1.22.1 contain a flaw in how they validate offsets within uncompressed HEIF files. An attacker can craft a malicious HEIF file that bypasses safety checks due to integer wraparound, then tricks the library into reading data from memory locations outside the intended buffer. This causes the application to crash and may leak information. The issue requires user interaction—someone must open the malicious file—but affects any application embedding libheif.

• CVE-2026-50811MEDIUM 6.5

  FreeType, a widely-used font rendering library, contains an out-of-bounds read flaw in its variable font handling code. When processing specially crafted TrueType variable fonts, the library reads memory beyond allocated boundaries, potentially exposing sensitive data or causing the application to crash. This affects FreeType version 2.14.3 and earlier versions prior to a specific commit that patches the issue.

• CVE-2026-58011MEDIUM 6.5

  A bug in GLib's date-time handling can cause an out-of-bounds memory read when processing malformed date objects. This flaw corrupts date calculations and may trigger denial-of-service conditions. The vulnerability requires no authentication and can be triggered remotely, making it moderately serious for systems that parse or manipulate dates via affected GLib versions.

• CVE-2026-9263MEDIUM 6.5

  A vulnerability in Zephyr's Bluetooth controller allows a remote attacker to read sensitive memory from a device. The flaw exists in how the system handles Bluetooth ISO (isochronous) data frames. When a specially crafted ISO frame header arrives—either from a connected peer or a broadcaster the device is listening to—the controller fails to validate a length field properly. This causes it to read far more data from memory than it should and send that memory content to the host system as if it were legitimate data, exposing information that shouldn't be accessible. The vulnerability affects all Zephyr versions from 3.0.0 onward that support framed ISO reception.

• CVE-2026-9539MEDIUM 6.5

  CVE-2026-9539 is a memory disclosure vulnerability in libslirp, a user-mode TCP/IP stack commonly used in hypervisor environments like QEMU. A privileged attacker running inside a guest virtual machine can craft malicious TCP packets to read sensitive data from the host system's memory. The vulnerability stems from improper handling of TCP urgent data flags and pointers, combined with an integer underflow condition. The attacker needs elevated privileges within the guest (root or CAP_NET_RAW capability), but can leak gigabytes of host heap memory, potentially exposing cryptographic keys, session tokens, or other confidential information.

• CVE-2026-9908MEDIUM 6.5

  CVE-2026-9908 is a memory disclosure flaw in Google Chrome's ANGLE graphics library that lets attackers read uninitialized or sensitive data from your browser process. An attacker crafts a malicious HTML page; when you visit it, the bug leaks information that shouldn't be accessible—such as encryption keys, session tokens, or other sensitive values that happened to be in memory. The vulnerability requires user interaction (clicking through to a malicious site) but no authentication, and it affects Chrome versions before 148.0.7778.216.

• CVE-2026-9953MEDIUM 6.5

  CVE-2026-9953 is a memory safety bug in the ANGLE graphics library used by Google Chrome that allows an attacker to read sensitive data from the browser process. An attacker can craft a malicious HTML page that, when visited by a user, exploits an out-of-bounds read to leak information like passwords, session tokens, or other confidential data stored in Chrome's memory. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require special privileges and works across Windows, macOS, and Linux. Google has assigned it high severity within Chromium's security framework.

• CVE-2026-9996MEDIUM 6.5

  A flaw in Google Chrome's WebRTC component allows a remote attacker to trick a user into visiting a malicious webpage that reads sensitive data from the browser's memory. The vulnerability affects Mac users running Chrome versions before 148.0.7778.216. No user action beyond visiting a crafted page is required for the attacker to attempt exploitation.

• CVE-2026-42771MEDIUM 6.2

  CVE-2026-42771 is a vulnerability in OpenSSL's email address validation logic that can cause an application to crash when processing crafted email addresses. The flaw lies in how OpenSSL validates the local part (the part before the '@' symbol) of email addresses, particularly during S/MIME message validation. An attacker who can supply a malicious email address in an S/MIME message can trigger an out-of-bounds read that most likely results in a denial of service. The vulnerability does not allow data theft or system compromise beyond availability impact.

• CVE-2026-10305MEDIUM 6.1

  Samsung's rlottie animation library contains a vulnerability that allows reading data beyond the intended buffer boundaries. When processing specially crafted animation files, the library may access memory it shouldn't, potentially exposing sensitive information or causing the application to crash. The issue stems from insufficient bounds checking during buffer operations. While the vulnerability requires user interaction (opening a malicious animation file) and is limited to local access, the combination of integrity impact and high availability risk warrants prompt attention.

• CVE-2026-5071MEDIUM 6.1

  A vulnerability in the SocketCAN network socket implementation allows a local user to trigger an out-of-bounds memory read by sending a specially crafted network frame with a truncated buffer. The flaw stems from insufficient validation—the code relies on a disabled assertion to catch buffer length issues, but in production builds where assertions are turned off, this check is bypassed entirely. An attacker can then cause the system to crash or leak sensitive memory contents to the network.

• CVE-2026-57241MEDIUM 6.1

  A vulnerability in Foxit PDF Editor and Reader allows an attacker to crash the application by crafting a malicious PDF file containing JavaScript. When the PDF is opened, the JavaScript code modifies page-related data structures in memory, causing them to become out of sync with what the renderer believes to be the current state. The application continues to trust an outdated page count and eventually attempts to access memory beyond valid bounds, leading to a denial of service. This requires user interaction (opening a PDF file) and affects only the local system, but can reliably crash the application.

• CVE-2026-57243MEDIUM 6.1

  A flaw in how Foxit's PDF applications handle JavaScript during document opening and form formatting can cause the application to crash. The vulnerability stems from a reentrancy issue—where JavaScript code is executed recursively before the previous execution completes—leaving the document in an inconsistent state. When the application then tries to access memory addresses based on outdated page information, it attempts to read from invalid locations, triggering a denial-of-service condition. An attacker would need to trick a user into opening a malicious PDF file to exploit this issue.

• CVE-2026-57253MEDIUM 6.1

  A flaw in Foxit PDF Editor and Reader allows a specially crafted PDF with an abnormal image object to crash the application. When the renderer processes the image's scan lines, it follows an incorrect code path and attempts to read from an invalid memory location, causing an immediate denial of service. The issue requires user interaction—opening a malicious PDF—but poses a genuine availability risk in environments where PDF handling is routine.

• CVE-2026-57255MEDIUM 6.1

  A vulnerability in PDF reader and editor applications allows a specially crafted PDF file with a malformed color space function to trigger an out-of-bounds memory access. When the application processes the PDF, the unvalidated function output creates an illegal pointer that crashes the application. This requires user interaction—the PDF must be opened—but poses a local denial-of-service risk and potential information disclosure through memory leakage.

• CVE-2026-57257MEDIUM 6.1

  CVE-2026-57257 is a memory safety flaw in Foxit PDF Editor and Reader that crashes the application when processing a specially crafted PDF file. The vulnerability stems from insufficient validation of entity indices during PRC (a PDF internal format) parsing, allowing an attacker to read memory beyond array boundaries. When a user opens a malicious PDF, the application crashes due to an out-of-bounds read, resulting in a denial of service. This is a local attack that requires user interaction—the victim must open the malicious file.

• CVE-2026-57258MEDIUM 6.1

  A vulnerability in PRC file parsing affects Foxit PDF Editor and Reader, as well as certain Windows and macOS systems. The issue stems from unsafe handling of file structure metadata: when a PRC file is opened, the application trusts the header information describing the file's array layout without validating it. An attacker can craft a malicious PRC file with misleading structure data that causes the application to read beyond allocated memory boundaries. This leads to crashes and potential information disclosure. User interaction is required—the victim must open the specially crafted file.

• CVE-2026-57454MEDIUM 6.1

  Vim versions 9.2.0320 through 9.2.0678 contain a memory safety flaw in how they handle undo and swap files. When a crafted file contains specially malformed virtual-text properties—metadata that Vim uses to annotate text—the editor fails to validate that the offset and length values actually point to valid memory locations. This causes Vim to read data outside the intended memory region, potentially crashing the application or exposing sensitive information from adjacent heap memory. The vulnerability is triggered when a user opens or restores such a malicious file, making it a user-interaction risk rather than a network-based threat.

• CVE-2026-58304MEDIUM 6.1

  Samsung's Escargot JavaScript engine contains a memory safety vulnerability that allows an attacker to read from or write to memory locations outside the intended buffer boundaries. An attacker with local access who tricks a user into opening a malicious file or visiting a compromised page can trigger the overflow, potentially crashing the application or modifying memory to achieve unintended behavior. This is not currently a known exploited vulnerability in the wild.

• CVE-2026-58307MEDIUM 6.1

  CVE-2026-58307 is a memory safety flaw in Samsung's Escargot JavaScript engine that allows an attacker to read past the end of a buffer and trigger an assertion failure. By crafting malicious input and requiring user interaction (such as opening a file or visiting a page), an attacker can cause the application to crash or potentially disclose sensitive data. The vulnerability is rated medium severity because it requires local access and user engagement, but the availability impact is substantial.

• CVE-2026-14406MEDIUM 5.9

  A flaw in Chrome's V8 JavaScript engine allows an out-of-bounds memory read when a malicious browser extension executes. An attacker would first need to trick a user into installing a malicious extension, then use it to read sensitive data directly from the browser's memory. This is classified as a medium-severity issue because it requires social engineering to deliver the extension, but once installed, it can expose potentially sensitive information without further user interaction.

• CVE-2026-45681MEDIUM 5.9

  OpenTelemetry eBPF Instrumentation versions prior to 0.9.0 contain a memory disclosure vulnerability triggered by CPU scheduling mismatches. When the instrumentation falls back to a 256-byte buffer but retains the original payload size marker (up to 8KB), a mismatch between CPUs can cause the code to read memory beyond the buffer boundary. This leaked memory is inadvertently captured and exported as telemetry data, potentially exposing sensitive information from adjacent kernel memory to anyone consuming the telemetry stream.

• CVE-2026-48682MEDIUM 5.9

  FastNetMon Community Edition versions up to 1.2.9 contain a flaw in how it reads and interprets network packet headers. When processing IPv4 packets, the software validates that a packet has at least a minimum header size, but then makes unsafe assumptions about header field values. Specifically, it reads past the actual packet boundary when a packet header contains an unusually large size indicator, or it misinterprets packet data when that indicator is too small. This can cause the software to read memory it shouldn't access or misidentify packet contents, potentially leading to information disclosure or unexpected behavior.

• CVE-2026-46690MEDIUM 5.8

  A memory safety vulnerability exists in unbounded_spsc versions 0.2.0 and earlier, a Rust library for lock-free message passing. The flaw occurs when the sender transmutes a pointer as a value and then sends it, which can cause the receiver to read memory outside the intended bounds or incorrectly drop a reference-counted object if the sender and receiver operate concurrently. This could lead to information disclosure or denial of service. No public patches are currently available.

• CVE-2026-0165MEDIUM 5.7

  CVE-2026-0165 is a medium-severity vulnerability in Android's RTCP (Real-Time Control Protocol) packet decoder that allows an attacker to read sensitive information from device memory without needing special permissions. The flaw stems from missing boundary checks that permit out-of-bounds memory access. Exploitation requires user interaction—such as accepting a call or media stream—but once triggered, the vulnerability can leak confidential data like encryption keys, authentication tokens, or other sensitive information stored in adjacent memory regions.

• CVE-2026-14063MEDIUM 5.7

  CVE-2026-14063 is a memory disclosure vulnerability in Google Chrome's Chromecast component that allows a local attacker to read sensitive data from the browser process. The flaw requires the attacker to be on the same network and the user to interact with malicious network traffic, but does not require elevated privileges. While individual impact is modest, this type of information leak can enable reconnaissance for more sophisticated attacks. Google rated the underlying issue as low severity, but the combination of local network access, user interaction requirement, and memory disclosure capability warrants MEDIUM priority in most enterprise environments.

• CVE-2026-45359MEDIUM 5.7

  ImageMagick, a widely-used image editing library, contains a memory safety flaw in its connected components operation. When the connected-components:keep-top parameter receives an invalid value, the software can read beyond allocated memory boundaries. While the vulnerability requires specific input conditions and local system access, it may allow an attacker to extract sensitive data or crash the application. Versions 6.9.13-48 and 7.1.2-22 patch this issue.

• CVE-2026-47166MEDIUM 5.7

  ImageMagick, a widely-used image editing tool, contains a memory safety flaw in its distributed caching service. An attacker with local access who can connect to the magick -distribute-cache service can trigger the server to read beyond allocated heap memory, potentially exposing sensitive data or causing a denial of service. The vulnerability affects versions before 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch).

• CVE-2026-1764MEDIUM 5.6

  GNOME localsearch, a desktop search indexing tool, contains a memory safety flaw in its MP3 metadata parser. When a specially crafted MP3 file with ID3v2.4 tags is processed, the software fails to properly validate tag boundaries before reading heap memory. This can crash the indexing process or leak sensitive data from the application's memory space. The vulnerability requires local access and user interaction—a user must open or index a malicious MP3 file—but the consequences can include service disruption and unintended data exposure.

• CVE-2026-1765MEDIUM 5.6

  GNOME localsearch contains a heap buffer overflow vulnerability in its MP3 file processing component. When a user opens a specially crafted MP3 file, the application can crash unexpectedly. There is also a potential risk that sensitive data from system memory could be exposed during the crash. This is a locally-triggered vulnerability—an attacker must first convince a user to open a malicious file rather than launching an attack remotely over the network.

• CVE-2020-9711MEDIUM 5.5

  Adobe Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier contain a flaw that allows an attacker to read sensitive data from a computer's memory when a user opens a specially crafted PDF file. The vulnerability does not allow attackers to modify files or crash the application, but it does expose information that should remain private. An attacker would need to trick someone into opening a malicious PDF to exploit this issue.

• CVE-2020-9713MEDIUM 5.5

  CVE-2020-9713 is a memory disclosure vulnerability in Adobe Acrobat and Reader that allows an attacker to read sensitive data from a victim's computer. The flaw occurs when the application improperly accesses memory outside intended boundaries while processing a malicious PDF file. An attacker must trick a user into opening a crafted document to exploit it—there is no remote attack vector. While the vulnerability cannot directly crash the application or alter files, it can expose confidential information such as cached credentials, encryption keys, or other sensitive data resident in memory at the time of exploitation.

• CVE-2026-12444MEDIUM 5.5

  A memory reading vulnerability exists in Google Chrome's Chromoting feature (Google's remote desktop tool) on Windows systems running versions prior to 149.0.7827.155. An attacker with local access to a machine can craft a malicious file that, when interacted with by a user, causes Chrome to read data outside its intended memory boundaries. This out-of-bounds read could expose sensitive information already present in the process's memory—such as cached authentication tokens, encryption keys, or other confidential data—without requiring elevated privileges or special system access. The vulnerability is not currently known to be exploited in the wild.

• CVE-2026-21038MEDIUM 5.5

  CVE-2026-21038 is a memory access vulnerability in Samsung's Android USB Driver for Windows. A locally authenticated user can trigger improper input validation to read sensitive data from memory outside the bounds of allocated buffers. The vulnerability requires local access and an authenticated session but does not require user interaction. It affects confidentiality but not integrity or availability.

• CVE-2026-34705MEDIUM 5.5

  Adobe InDesign has a memory-reading vulnerability that can expose sensitive data stored in the application's working memory. When a user opens a specially crafted file, the vulnerability allows an attacker to read beyond the intended boundaries of memory, potentially revealing passwords, encryption keys, or other confidential information. This is a local attack that requires user interaction—the victim must be tricked into opening a malicious file. The vulnerability affects InDesign versions 21.3, 20.5.3, and earlier on both Windows and macOS systems.

• CVE-2026-42968MEDIUM 5.5

  Windows Telephony Service contains a flaw that allows a local, authenticated user to read data from a portion of memory that the program doesn't properly protect. An attacker must already have legitimate login credentials and local system access; they cannot exploit this remotely. The leaked information could include sensitive data, but the attacker cannot modify systems or prevent them from functioning. This affects a wide range of Windows 10 and Windows 11 versions, as well as Windows Server 2012 through 2025.