CVE-2026-55564 is an out-of-bounds read vulnerability in FreeRDP versions prior to 3.27.0. The flaw exists in the glyph_cache_get function, which incorrectly checks an index against cache->number, allowing a malicious RDP server to cause a read beyond the bounds of an array. This can lead to client crashes and potential disclosure of adjacent heap memory. The issue is fixed in FreeRDP version 3.27.0.
A vulnerability in the Nimiq blockchain Rust implementation (up to version 1.5.0) causes a validity store off-by-one error that allows replaying signed transactions within a specific block window, resulting in double updates to sender and recipient balances. This flaw is fixed in version 1.5.1.
GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This exposes heap memory contents which can be later used to defeat ASLR. This issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe
In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in 'harden-below-nxdomain' logic; enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is never contacted. 'harden-below-nxdomain' does an upward DNS cache walk together with a delegation point guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but before stripping a label. This results in an iteration where the domain name equals the configured stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apex's immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, which it will for any private namespace nested two or more labels under a signed public name, the walk returns it and the configured stub/forward upstream is never contacted. This can only be triggered by the query for the intermediate label (between the stub/forward apex and the DNSSEC parent zone).
A stack buffer overflow vulnerability exists in GIMP's PNM file format parser due to an off-by-one error in the pnmscanner_gettoken() function. This flaw can cause memory corruption when processing specially crafted PNM files, potentially leading to denial of service or arbitrary code execution. Red Hat has issued a security update addressing this issue in GIMP for Red Hat Enterprise Linux 9.
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.
Gogs versions prior to 0.14.3 contain an off-by-one error vulnerability (CWE-193) in the ChangeCollaborationAccessMode function. This flaw allows a repository admin collaborator to escalate their privileges to owner-level access. The vulnerability is fixed in version 0.14.3.
LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.
nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255.
bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, a one-byte off-by-one error in SafeOutPathBuilder::restoreSymlink() allows an attacker to craft a .7z archive that, when extracted with bit7z on any non-Windows platform, creates a symlink escaping the intended output directory. Subsequent archive entries extracted through this symlink write arbitrary files outside the extraction directory with the permissions of the extracting process. This issue has been patched in version 4.0.12.
An off-by-one error in the PKCS#12 bag element bounds check in gnutls allows a remote attacker to write past the internal array when appending to a bag with 32 elements. This memory corruption can cause a denial of service (DoS) or potentially other unspecified impacts. The vulnerability is tracked as CVE-2026-42015 with a CVSS score of 5.3 (medium severity). Red Hat has released security updates addressing this issue in their Extended Life Cycle Support 7 packages.
CVE-2026-44603 is an off-by-one error vulnerability in Tor versions before 0.4.9.7. It involves an out-of-bounds read by one byte triggered by a malformed BEGIN cell. The vulnerability is classified as CWE-193 and has a low severity with a CVSS score of 3.7. There are no known exploits in the wild, and no official patch or remediation level has been confirmed yet.
An off-by-one error in Velocidex Velociraptor versions before 0.76.5 on Windows and Linux can cause a denial of service via a process crash when parsing a specially crafted . evtx file using the parse_evtx VQL plugin. This vulnerability requires local access and user interaction to trigger. It does not impact confidentiality but can affect availability by crashing the process.
CVE-2026-43860 is an off-by-one error vulnerability in mutt versions before 2.3.2 where the hash_passwd is sometimes truncated by one byte during IMAP auth_cram MD5 digest processing. This flaw can lead to integrity issues but does not impact confidentiality or availability.
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses > instead of >= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0.
CVE-2026-22593 is a high-severity vulnerability in the EVerest everest-core EV charging software stack. It is caused by an off-by-one error in the IsoMux certificate filename handling prior to version 2026.02.0. When a filename length equals the maximum allowed length (100), a stack-based buffer overflow occurs, potentially allowing corruption of stack state and code execution. This vulnerability is patched in version 2026.02.0.
CVE-2026-34085 is an off-by-one error vulnerability in the fontconfig library before version 2.17.1. The flaw occurs in the allocation logic during sfnt capability handling within the FcFontCapabilities function in fcfreetype.c, causing a one-byte out-of-bounds write. This vulnerability can lead to a crash or potentially allow code execution. The CVSS score is 5.9, indicating a medium severity level. No patch or official fix information is provided in the available data. There are no known exploits in the wild at this time.