CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-47515 is an out-of-bounds read vulnerability in the NVIDIA GeForce GPU Display Driver kernel mode layer for Windows and Linux. It involves an unbounded string operation that could be exploited by a user with high privileges. Exploitation may result in code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a CVSS score of 6.7, indicating medium severity. No specific affected versions or patch information are provided.

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module through which an attacker might initiate an out-of-bounds read. Successful exploitation of this issue could lead to denial of service and information disclosure.

CVE-2026-47545 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It involves an out-of-bounds read in the kernel mode layer. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. No specific affected versions or patch information are provided.

CVE-2026-47513 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It involves an out-of-bounds read in the kernel mode layer that could be exploited by a user with limited privileges. Successful exploitation may result in code execution, denial of service, privilege escalation, information disclosure, and data tampering. No specific affected versions or patch information are provided.

CVE-2026-47512 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It involves an out-of-bounds read in the kernel mode layer that can lead to kernel information disclosure. Exploitation could potentially allow code execution, denial of service, privilege escalation, information disclosure, and data tampering.

Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified. The matches, first_match and match_details methods use the T_STD_STRING typemap to translate Perl scalars (SVs) into strings via the std::string constructor, using the SvPV macro to stringify the haystack input, and the SvCUR macro to determine the length of the SV. When the input SVs are references, integers (IVs) or floats (NVs), the SvCUR macro will return an invalid length if it is run before the input is stringified, leading to an out-of-bounds read which can abort the process. Note that the evaluation order of arguments to std::string is unspecified. Depending on the compiler, SvCUR may be run first and lead to an abort that cannot be caught within Perl. This can be triggered when the haystack is a numeric value, for example, my $ac = Algorithm::AhoCorasick::XS->new( [ "11", "22" ] ); $ac->matches( 211 ); This can occur when the haystack is the result of reading data from decoded JSON or a numeric database column. It can also be triggered when using a blessed object as a haystack.

CVE-2026-102717 is a high-severity vulnerability in Eclipse Foundation's NetX Duo affecting versions 6.4.4 through 6.5.1.202602. It involves an out-of-bounds read caused by an MQTT WebSocket setter ABI mismatch, which may lead to memory disclosure or application crashes.

CVE-2026-102820 is an out-of-bounds read vulnerability in the Windows pageant crate used by Eugeny's russh library. The flaw exists in the MemoryMap::read function prior to pageant version 0.2.3, where a peer-controlled 32-bit response length is trusted, allowing a local process impersonating the Pageant window to cause a large memory allocation and read beyond the mapped memory. This can crash the russh client and potentially expose adjacent committed memory. The issue is fixed in pageant 0.2.3.

CVE-2026-102726 is a high-severity vulnerability in Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a. The PPP IPCP code improperly parses Configure-Nak options without validating their length, allowing a malicious PPP peer to stall the PPP thread indefinitely and read up to four bytes of packet-buffer memory per exchange.

CVE-2026-102725 is an out-of-bounds read vulnerability in Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a when built with VLAN and SRP support. The flaw arises because the MSRP parser uses the attribute list length from a received frame without validating it against the actual packet length. This allows an unauthenticated attacker on the same Layer 2 segment to send a malformed MSRP frame that causes the MRP worker to read beyond the packet boundary, potentially causing a fault on systems with memory protection.

CVE-2026-102721 is an out-of-bounds read vulnerability in Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a. The flaw occurs in the TFTP client and server handling of ERROR packets, where the client copies error message data without proper bounds checking, and the server reads beyond the minimal packet size. This can lead to leakage of adjacent memory or faults on systems with memory protection.

CVE-2026-102720 is an out-of-bounds read vulnerability in Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a. The DHCP client improperly advances its option walk offset, causing it to read up to about one kilobyte beyond the received DHCP message. This can lead to copying out-of-bounds bytes into the application's buffer when retrieving user options.

CVE-2026-102718 is a high-severity vulnerability in Eclipse ThreadX NetX Duo (up to version 6.5.2.202603) where the SNMP agent's OID parser improperly handles multi-byte BER lengths, leading to out-of-bounds reads. A remote unauthenticated attacker can exploit this by sending a crafted SNMP request, causing the agent to read memory beyond the packet buffer and potentially fault on systems with memory protection.

CVE-2026-102714 is a high-severity vulnerability in Eclipse ThreadX NetX Duo up to version 6.5.2.202603 when built with IPv6. It involves an out-of-bounds read caused by improper validation of ICMPv6 options, allowing a local host to send crafted messages that cause the IP thread to read beyond packet boundaries or loop indefinitely. This can lead to memory corruption in the neighbor cache.

CVE-2026-102713 is a high-severity vulnerability in Eclipse ThreadX NetX Duo up to version 6.5.2.202603. The TFTP server component, when built with packet chaining, does not properly limit the length of received DATA datagrams. This allows an unauthenticated attacker to upload an oversized datagram that causes out-of-bounds memory writes into files and can also suspend the server thread permanently.

CVE-2026-102712 is an out-of-bounds read vulnerability in Eclipse ThreadX NetX Duo versions up to 6.5.2.202603 when built with DTLS server support. The vulnerability arises in the NetX Secure DTLS server's ClientHello parser, which reads certain fields without proper bounds checking, potentially causing the server to read beyond the message buffer. This can lead to a fault on targets that trap out-of-bounds memory accesses. No data is leaked back to the attacker, and exploitation requires sending a specially crafted ClientHello message.

CVE-2026-102711 is an out-of-bounds read vulnerability in Eclipse ThreadX versions 6.0.1 through 6.5.2.202603. The vulnerability arises because the Module Manager loaders trust the sizes and offsets declared in a module image preamble without verifying the actual image length. A crafted module image can declare a larger code size than the actual image, allowing reading or accessing memory beyond the intended boundaries and placing entry points outside the legitimate code area.

CVE-2026-102757 is a high-severity vulnerability in the Eclipse Foundation's ThreadX real-time operating system. It allows an unprivileged, memory-protected module to manipulate kernel memory in privileged mode, bypassing isolation boundaries by clearing the MPU enable bit. This occurs due to improper validation in the Module Manager's object dereference logic, enabling an attacker to craft addresses that pass checks incorrectly and gain privileged memory access.

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.

A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.