CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-44034 is a heap-based out-of-bounds read vulnerability in OFFIS DCMTK version 3.7.0. It occurs in the DcmRLECodecDecoder::decodeFrame() function when processing crafted RLE Lossless DICOM files with pixel data fragments shorter than the expected 64-byte RLE header. This flaw allows reading up to 63 bytes of adjacent heap memory or may cause a crash. The issue affects applications decoding RLE images frame by frame but not the dcmdrle command-line tool. The vulnerability has a medium severity with a CVSS score of 4.8 and is fixed in a later commit.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_test[] and extend_offset[] tables, causing incorrectly decoded pixel data or a crash, via a DICOM file with a crafted JPEG stream whose Huffman table defines a difference category above 15. Huffman symbol values are not range-checked unless DCMTK is built with DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK, which is disabled by default. dcmdjpeg and any application that decompresses JPEG DICOM images with DCMTK are affected. The issue is fixed in commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5.

CVE-2026-107220 is an out-of-bounds read vulnerability in the qax-os excelize Go library versions 2.7.1 through 2.11.0. The issue occurs when processing a crafted worksheet containing an empty mergeCell ref, leading to an empty cached rectangle slice being passed without length checks. This causes an out-of-bounds slice access in cellInRange, resulting in a panic during cell operations. No fix is currently available.

NVIDIA TensorRT contains a vulnerability where an attacker can cause an out of bounds read. A successful exploit of this vulnerability may lead to denial of service.

CVE-2026-19029 is a heap-based buffer over-read vulnerability in the HDF5 library (The HDF Group) affecting versions prior to 2.2.0. The flaw exists in the H5Z__filter_scaleoffset() function, where an attacker can craft a malicious HDF5 file that triggers a denial of service via application crash. This occurs because the decoder copies data from a compressed chunk without verifying the chunk size when certain filter parameters are attacker-controlled.

CVE-2026-102164 is an out-of-bounds read vulnerability (CWE-125) affecting Arista Networks Wi-Fi Access Points when configured with VXLAN tunnelling and L2-proxy in the VESPA use-case. A wireless client connected to the tunnelled SSID can send a crafted packet that causes the access point to leak memory contents in network traffic. This vulnerability does not allow write access or remote code execution. The CVSS score is 3.1, indicating low severity.

GNU Aspell contains an out-of-bounds read vulnerability in the ReadOnlyDict::load() function within readonly_ws.cpp. This occurs when loading a binary .rws dictionary file, where offset fields from the file header are used as byte indices into a heap buffer without proper bounds validation. An attacker can exploit this by supplying a crafted dictionary file via --master, --dict-dir, or configuration options, potentially causing heap memory disclosure or a denial of service through application crash. This vulnerability is fixed in version 0.60.8.3.

In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01797547; Issue ID: MSV-9155.

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normally restarted automatically, repeated requests can sustain the service interruption.

CVE-2026-47592 is a high-severity out-of-bounds read vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It occurs in the kernel mode layer and can be triggered by an unprivileged user. Exploitation may result in code execution, denial of service, privilege escalation, information disclosure, and data tampering. No specific affected versions or patch information are provided.

CVE-2026-47544 is a high-severity vulnerability in the NVIDIA Virtual GPU Manager for Linux. It involves an out-of-bounds read in the kernel mode layer. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a CVSS score of 7.8. No specific affected versions or patch information is provided.

CVE-2026-47536 is a high-severity vulnerability in the NVIDIA Virtual GPU Manager for Linux. It involves an out-of-bounds read in the kernel mode layer, which could be exploited by an attacker with limited privileges. Successful exploitation may result in code execution, denial of service, privilege escalation, information disclosure, and data tampering.

NVIDIA Virtual GPU Manager for Linux has a firmware vulnerability involving an out-of-bounds read. Exploitation could result in code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability is identified as CWE-125 and has a high severity CVSS score of 7.8.

NVIDIA Virtual GPU Manager for Linux contains a kernel mode layer vulnerability involving an out-of-bounds read. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability is identified as CWE-125 and has a high severity rating with a CVSS score of 7.8. No specific affected versions or patches are currently provided.

CVE-2026-47520 is a high-severity vulnerability in the NVIDIA vGPU Virtual GPU Manager for Linux kernel mode layer. It involves an out-of-bounds read that could be exploited by an attacker with local privileges. Successful exploitation may lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering.

CVE-2026-47519 is a high-severity vulnerability in the NVIDIA vGPU Virtual GPU Manager for Linux kernel mode layer. It involves an out-of-bounds read that could be exploited by an attacker with local privileges. Successful exploitation may result in code execution, denial of service, privilege escalation, information disclosure, and data tampering.

CVE-2026-47499 is a high-severity vulnerability in the NVIDIA Virtual GPU Manager for Windows and Linux. It involves an out-of-bounds read in the kernel mode layer that could be exploited by a guest. Successful exploitation may lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering.

CVE-2026-47527 is an out-of-bounds read vulnerability in the NVIDIA GeForce GPU Display Driver firmware for Windows and Linux. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a CVSS score of 6.7, indicating medium severity. No specific affected versions or patch information are provided.

CVE-2026-47524 is an out-of-bounds read vulnerability in the NVIDIA GPU Display Driver kernel mode layer for Windows and Linux. Exploitation could allow attackers with high privileges to execute code, cause denial of service, escalate privileges, disclose information, or tamper with data. The vulnerability has a CVSS score of 6.7, indicating medium severity. No affected versions or patch information are provided.