By weakness (CWE)

CWE-129: related vulnerabilities

CVEs classified under CWE-129. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

22 published vulnerabilities

• CVE-2026-13131HIGH 8.3

  GeoWebPlayer is a plugin used by various GeoVision surveillance and management software products (GV-VMS, GV-Cloud, and others) to provide enhanced web interface capabilities via a WebSocket server. A flaw in how the plugin validates user input allows attackers to access memory regions outside intended boundaries by supplying out-of-range index values in commands like `connectInfo`. Because the WebSocket server accepts connections from localhost, an attacker who has already gained local network access or code execution on the host system could exploit this to read sensitive data, modify system behavior, or crash the application.

• CVE-2026-13132HIGH 8.3

  GeoWebPlayer is a browser plugin used by GeoVision surveillance software (GV-VMS, GV-Cloud, and related platforms) to enable advanced web interface features. The plugin runs a local websocket server that accepts commands from the browser. A critical flaw exists in how the plugin validates index parameters passed in commands like `setStream`—it fails to verify that these index values fall within valid array bounds. An attacker who can trick a user into visiting a malicious webpage while logged into a GeoVision web interface could send specially crafted websocket commands that access memory beyond intended array boundaries, potentially leading to information disclosure, unauthorized control changes, or system crashes.

• CVE-2026-57264HIGH 8.3

  GeoWebPlayer, a plugin used by GeoVision software products (GV-VMS, GV-Cloud, and others), contains an index-out-of-bounds vulnerability in its websocket server. When the server processes commands like setPIP, it fails to validate that the supplied index parameter is within the valid range before using it to access arrays. An attacker with network access can send malformed commands to exploit this weakness, potentially reading sensitive data, modifying system state, or disrupting service availability. The vulnerability requires user interaction in some attack scenarios but has broad impact potential.

• CVE-2026-57265HIGH 8.3

  GeoWebPlayer is a plugin component used by GeoVision software products (GV-VMS, GV-Cloud, and related solutions) to enable advanced web interface functionality through a local WebSocket server. A flaw in this WebSocket server allows unauthenticated remote attackers to send crafted commands with out-of-bounds index values that bypass array bounds checking. This can lead to unauthorized access to sensitive data, modification of system settings, or denial of service. The vulnerability requires user interaction or network proximity to exploit, but once triggered, can affect the broader web interface and potentially downstream systems.

• CVE-2026-57266HIGH 8.3

  GeoWebPlayer, a browser plugin used by GeoVision surveillance software (GV-VMS, GV-Cloud, and related products), contains an array bounds checking vulnerability in its websocket server. When processing certain commands from the local network, the plugin fails to validate an 'index' parameter before using it to access memory arrays. An attacker with network access to the websocket server can supply out-of-bounds index values to trigger memory corruption, potentially leading to information disclosure, code execution, or denial of service. The plugin appears designed for localhost communication, but misconfiguration or network exposure could widen the attack surface.

• CVE-2026-57267HIGH 8.3

  GeoWebPlayer is a plugin that extends web-interface functionality for GeoVision surveillance systems (GV-VMS, GV-Cloud, and related products). It operates a WebSocket server accessible from localhost that accepts administrative commands. A critical flaw exists in how the plugin validates input parameters: when commands reference array indices, the plugin does not properly check whether those indices fall within valid bounds. An attacker who can reach the WebSocket server can supply out-of-bounds index values to access memory regions beyond intended arrays, potentially reading sensitive data, modifying system state, or crashing the service.

• CVE-2026-57268HIGH 8.3

  GeoWebPlayer is a browser plugin used by GeoVision surveillance systems (GV-VMS, GV-Cloud, and related products) to enhance web interface functionality via a local WebSocket server. The plugin fails to validate an 'index' parameter in the `saveVideo` command, allowing an attacker on the local network to access memory regions outside intended array boundaries. By crafting a malicious WebSocket message with an out-of-bounds index, an attacker can read or manipulate critical program state, potentially executing arbitrary code on the system running GeoVision software.

• CVE-2026-57269HIGH 8.3

  GeoWebPlayer is a browser plugin used by GeoVision surveillance software (GV-VMS, GV-Cloud) to enable advanced web interface capabilities via a local websocket server. A critical flaw allows attackers to send specially crafted commands to this local server that bypass index validation checks, enabling out-of-bounds array access. This can lead to unauthorized data exposure, system compromise, or denial of service. The attack requires user interaction (the target must visit a malicious webpage) and network access to the victim's system, but succeeds regardless of whether the user has administrative privileges.

• CVE-2026-57270HIGH 8.3

  GeoWebPlayer, a browser addon for GeoVision surveillance software (GV-VMS, GV-Cloud, and related systems), contains an index validation flaw in its WebSocket server. When processing certain commands, the addon fails to verify that array indices are within valid bounds before accessing memory. An attacker can exploit this by sending specially crafted commands over a network connection to trigger out-of-bounds memory access, potentially leading to information disclosure, system modification, or denial of service.

• CVE-2026-57271HIGH 8.3

  GeoWebPlayer, a browser plugin component of GeoVision's surveillance and video management software, contains a memory safety flaw in how it processes certain pause commands. An attacker can exploit this by crafting a malicious webpage or intercepting network traffic to trigger an out-of-bounds memory access, potentially leading to data theft, system manipulation, or denial of service. The flaw requires user interaction (clicking a link or visiting a compromised site) but can affect multiple GeoVision products including GV-VMS, GV-Cloud, and cloud-based VMS deployments.

• CVE-2026-57272HIGH 8.3

  GeoWebPlayer, a browser addon used with GeoVision surveillance software (GV-VMS, GV-Cloud, and others), contains an array index validation flaw in its websocket server. Attackers who can reach the websocket endpoint—typically requiring local network access or user interaction to trigger—can send specially crafted commands with out-of-bounds index values to read or modify sensitive memory regions. This can lead to information disclosure, system compromise, or denial of service affecting the surveillance infrastructure.

• CVE-2026-14191HIGH 7.8

  WinRAR and UnRAR contain a critical memory corruption vulnerability in how they handle RAR5 recovery volume sets (.rev files). When processing multiple recovery files together, the software fails to properly validate file boundaries, allowing an attacker to write malicious data to unintended memory locations. An attacker can exploit this by providing a crafted set of recovery files that, when a user attempts to repair or test an archive, corrupt the application's internal data structures. This can lead to information disclosure, data corruption, or potential code execution depending on what adjacent objects occupy the corrupted memory.

• CVE-2026-46122HIGH 7.8

  A flaw exists in the Linux kernel's b43 wireless driver that can allow a local attacker to read memory outside the bounds of an internal array. The issue stems from insufficient validation of a firmware-supplied index value used to access encryption keys. When the firmware provides an invalid index—one larger than the 58-entry key array—the driver does not properly reject it in production systems, leading to an out-of-bounds read. An attacker with local system access could exploit this to leak sensitive kernel memory.

• CVE-2026-46163HIGH 7.8

  A flaw exists in the Linux kernel's b43legacy wireless driver that fails to properly validate array index bounds when processing incoming wireless frames. The firmware supplies a key index value that the driver uses to access a cryptographic key array, but there is no enforcing check to ensure this index stays within valid bounds. In production builds, this allows an attacker with local access to trigger an out-of-bounds memory read by crafting malicious wireless traffic, potentially exposing sensitive kernel memory or causing a system crash.

• CVE-2026-52969HIGH 7.8

  A flaw in the Linux kernel's KVM (Kernel Virtual Machine) hypervisor allows a local user with access to /dev/kvm to trigger an out-of-bounds memory access. The vulnerability exists in the dirty ring mechanism—a performance optimization that tracks which guest memory pages have been modified. An attacker can craft specially-formed entries in the shared memory region backing the dirty ring to cause an integer overflow, bypass a bounds check, and access memory outside the intended slot boundaries. On affected systems using shadow paging (legacy MMU or write-tracked memory slots), this can lead to privilege escalation or denial of service.

• CVE-2026-57251HIGH 7.8

  CVE-2026-57251 is a memory safety vulnerability in Foxit PDF Editor and Reader that occurs when the application processes PDF files. The issue stems from improper bounds checking during PDF parsing—the code fails to enforce an upper limit on memory access, allowing reads or writes beyond the intended array boundaries. When a malicious or malformed PDF is opened, this out-of-bounds access crashes the application. While the immediate symptom is denial of service, the vulnerability's high CVSS score reflects that memory corruption of this type can potentially be exploited for information disclosure or code execution depending on memory layout and attacker sophistication.

• CVE-2026-56770HIGH 7.5

  CVE-2026-56770 is a denial-of-service vulnerability in libais, a library used to decode Automatic Identification System (AIS) messages from maritime vessels. The flaw allows attackers to crash services or vessel navigation systems by sending malformed AIS radio messages (AIVDM sentences) with invalid sequential message identifiers. When the library processes these crafted messages, it uses an unchecked index value that causes the application to access memory outside safe bounds, leading to a crash. This affects maritime monitoring systems, vessel bridge equipment, and shore-based AIS receivers that rely on libais for message decoding.

• CVE-2026-24181HIGH 7.3

  NVIDIA DALI, a data loading library commonly used in machine learning pipelines, contains a flaw in index validation that could allow a local attacker with user-level privileges to execute arbitrary code, modify data, crash the application, or steal sensitive information. The vulnerability requires user interaction and operates within a single user's security context, but the potential consequences span the full spectrum of system compromise.

• CVE-2026-52915HIGH 7.1

  A flaw in the Linux kernel's IPv6 hop-by-hop header filtering allows a local attacker with standard user privileges to trigger an out-of-bounds array access. The vulnerability exists because the kernel accepts oversized option lists in netfilter rules without validating that they fit within the fixed 16-element array used to store them. An attacker can craft a malicious firewall rule to cause the kernel to read or write beyond array boundaries, potentially enabling privilege escalation or denial of service.

• CVE-2026-32682MEDIUM 6.5

  NGINX Gateway Fabric can be crashed by an authenticated user who has permission to create or modify GRPCRoute resources. By submitting specially crafted GRPCRoute configurations that include certain backendRef filters, an attacker can force the control plane to shut down unexpectedly. This requires valid credentials and explicit permissions on the system, limiting but not eliminating the risk.

• CVE-2026-45359MEDIUM 5.7

  ImageMagick, a widely-used image editing library, contains a memory safety flaw in its connected components operation. When the connected-components:keep-top parameter receives an invalid value, the software can read beyond allocated memory boundaries. While the vulnerability requires specific input conditions and local system access, it may allow an attacker to extract sensitive data or crash the application. Versions 6.9.13-48 and 7.1.2-22 patch this issue.

• CVE-2026-45624MEDIUM 5.1

  ImageMagick, a widely used image editing library, contains an out-of-bounds memory read vulnerability in its polynomial distortion feature. When processing specially crafted image transformation arguments, the software reads 24 bytes of memory beyond the intended buffer boundary. This can expose sensitive data from the application's memory space. The vulnerability affects versions prior to 6.9.13-47 (legacy branch) and 7.1.2-22 (current branch) and has been patched in those releases.