CWE-126 vulnerabilities

CVE-2026-55606 is a buffer over-read vulnerability in the odhcpd DHCP server component used by OpenWrt. In versions 25.12 and earlier, a flaw in DHCPv6 self-loop detection causes memcmp() to read beyond the intended buffer size on little-endian systems. This can be triggered by a single unauthenticated DHCPv6 packet, leading to a 2560-byte overread from a 128-byte stack buffer. No patches are publicly available at the time of disclosure.

A high-severity out-of-bounds read vulnerability exists in the odhcpd DHCPv6 IA parser used by OpenWrt. Versions from 17.01.0 up to but not including 25.12.3 improperly handle IA_NA or IA_PD options with bodies shorter than expected, leading to reading adjacent stack memory. This can disclose sensitive stack data such as stack canaries and ASLR-related information. The issue is fixed in version 25.12.3.

CVE-2026-107928 is a high-severity buffer over-read vulnerability in curl when built with GnuTLS. It occurs because GnuTLS can report sending more bytes than were actually provided, leading curl to read memory beyond its send buffer. This flaw affects multiple curl versions from 8.8.0 through 8.22.0. Exploitation could lead to confidentiality, integrity, and availability impacts. No known exploits are reported in the wild, and no patch information is provided.

Pillow, a Python imaging library, contains a buffer over-read vulnerability in its TIFF tile and RGBA decode paths in versions from 8.1.0 up to but not including 13.0.0. This flaw arises when Pillow and libtiff interpret certain TIFF tags differently, leading Pillow to read beyond the intended row data. Exploiting this can result in exposure of adjacent heap data or a crash. The issue is resolved in version 13.0.0.

CVE-2026-112394 is a buffer over-read vulnerability in the python-pillow Pillow library prior to version 13.0.0. The issue occurs in the P;2L and P;4L raw decoders, where the unpackers can read beyond the end of an input buffer due to a mismatch between the calculated packed-pixel row size and the actual unpacked bit planes. This can lead to disclosure of up to three adjacent heap bytes or cause a process crash. The vulnerability is fixed in Pillow version 13.0.0.

A buffer over-read vulnerability exists in MariaDB server's ST_Area function when processing invalid WKB for MultiPolygon geometries. This occurs because the multi-polygon parser advances past a nested geometry header without verifying sufficient input remains. The flaw affects multiple MariaDB versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2. A low-privileged remote attacker can exploit this to disclose memory, potentially aiding in bypassing ASLR as part of a multi-vulnerability attack chain. The issue has been fixed in the stated fixed versions.

Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Buffer over-read in DNS Server allows an authorized attacker to disclose information over a network.

Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.

Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally.

Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally.

Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack.

Buffer over-read in Windows IKE Extension allows an authorized attacker to deny service over a network.

Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.

Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.