CWE-125: Out-of-bounds Read vulnerabilities

Adobe FrameMaker 2026 contains an out-of-bounds read vulnerability (CWE-125) that may allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 18.0.0.206 and 17.0.9.866. The CVSS 3.1 base score is 5.5, indicating a medium severity. There is no information about an available patch or vendor advisory confirming remediation status.

Adobe FrameMaker 2026 contains an out-of-bounds read vulnerability (CWE-125) that could allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 18.0.0.206 and 17.0.9.866. The CVSS score is 5.5, indicating a medium severity level.

An out-of-bounds read vulnerability exists in the ESP-IDF BlueDroid L2CAP configuration-option processing in certain versions prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1. A remote unauthenticated Bluetooth BR/EDR peer can send a malformed L2CAP configuration request causing the ESP32 Bluetooth stack to read beyond buffer boundaries, potentially leaking adjacent memory in the L2CAP Configuration Response. This affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. The issue is fixed in the specified versions.

FreeRDP versions from 2.0.0-beta1 before 3.28.0 have an out-of-bounds read vulnerability in the smartcard_LocateCardsByATRA_Call function. This flaw arises because the ATR pattern cbAtr byte count is not properly capped, allowing malicious RDP servers to send crafted ATR mask arrays. Exploiting this can leak heap memory bit-by-bit, potentially defeating ASLR and aiding remote code execution.

NVIDIA DALI contains a high-severity vulnerability (CVE-2026-65150) involving an out-of-bounds read (CWE-125). Exploitation could lead to information disclosure, data tampering, and denial of service. The vulnerability affects versions 0.0 through 2.2 inclusive. No specific patch or remediation details are provided in the available data.

NVIDIA DALI version 0.0 through 2.2 contains a high-severity out-of-bounds read vulnerability (CWE-125). Exploitation could lead to information disclosure and denial of service. The vulnerability requires local access with low privileges and user interaction. No known exploits are reported in the wild. No patch information is currently provided.

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

CVE-2026-84286 is a critical out-of-bounds read vulnerability in Turboderp-org's ExLlamaV3 version 3. The EXL3 loader uses an untrusted model-supplied index to select a CUDA kernel without verifying bounds, allowing a malicious model to cause a crash or potentially achieve controlled indirect kernel dispatch under specific memory conditions.

Progress MarkLogic Server versions 12.0.0 up to but not including 12.1.0 contain an out-of-bounds read vulnerability in query-processing functionality. This flaw allows a remote authenticated attacker to cause server instability or disclose limited information from process memory. The vulnerability is classified as CWE-125 and has a CVSS 3.1 score of 7.1, indicating high severity.

ImageMagick versions 7.1.0-21 before 7.1.2-32 have a heap buffer over-read vulnerability in the handling of the -fx option. This flaw allows crafted -fx expressions to read beyond allocated heap memory bounds, potentially disclosing limited memory contents. The vulnerability has a medium severity score of 4.8 and requires local privileges to exploit.

ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have an information disclosure vulnerability in the JPEG decoder. This flaw allows an out-of-bounds read that exposes uninitialized memory when processing crafted JPEG files. Attackers can exploit this by supplying malicious JPEG images to disclose sensitive memory contents.

ImageMagick versions 7.1.1-7 before 7.1.2-32 have a heap buffer over-read vulnerability caused by incorrect string termination in XMP profiles. An attacker can exploit this by providing a crafted image with a malformed XMP profile, leading to reading beyond allocated memory and potentially crashing the application.

FreeRDP versions 3.9.0 through before 3.32.0 contain an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers. This flaw occurs when malicious or compromised RDP servers send specially crafted unaligned RDPEAR payloads to clients using Remote Credential Guard, leading to potential over-reads and client process crashes.

FreeRDP versions 3.0.0 contain a heap out-of-bounds read vulnerability in the function freerdp_assistance_parse_all_elements_of(). This occurs because the parsing cursor advances without decrementing the remaining length, allowing the scan window to exceed the decrypted ConnectionString2 buffer. An attacker can exploit this by supplying a crafted .msrcIncident invitation file and password, causing xfreerdp to crash when the file is opened, even before establishing an RDP connection.

CVE-2026-109248 is a heap out-of-bounds read vulnerability in FreeRDP versions 3.0.0 before 3.32.0. It occurs in the WinPR clipboard function convert_filedescriptors_to_file_list(), which improperly processes a server-controlled FILEDESCRIPTORW structure without ensuring NUL termination. A malicious RDP server can exploit this by sending a specially crafted odd-length FILEDESCRIPTORW blob, causing crashes in X11, Wayland, and SDL clients when pasting server-copied files.

CVE-2026-21119 is a medium severity vulnerability involving an out-of-bounds read and write in the lib_sag_ai_sound_sep_v2.00.so component of Samsung Mobile Devices. This flaw allows local attackers to access memory beyond intended boundaries. It affects versions prior to the SMR Oct-2026 Release 1. The vulnerability requires local privileges and has low attack complexity, with no user interaction needed. No known exploits are reported in the wild.

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first. When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.

An out-of-bounds read vulnerability exists in the VarOpt union deserialization function of Apache DataSketches C++ versions from 2.0.0-incubating up to 5.2.0. The flaw occurs because the deserialization reads more bytes than available in a truncated serialized union, potentially reading up to 24 bytes past the input end. This can cause a crash (denial of service) and may expose adjacent memory contents. Only applications deserializing VarOpt unions from untrusted sources are affected. The issue is fixed in version 5.3.0.

CVE-2026-103635 is an out-of-bounds read vulnerability in the Apache DataSketches C++ library affecting the compact Theta sketch deserialization process. The vulnerability arises because header fields are read before verifying the input length, allowing crafted or truncated sketches to cause reads past the input end. This can lead to crashes (denial of service) and potential exposure of adjacent memory. The issue affects versions from 3.1.0 up to and including 5.2.0. Upgrading to version 5.3.0 resolves the vulnerability.