CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-102521 is a high-severity out-of-bounds read vulnerability in the decoder function `readFromDataView` of the dmonad lib0 library versions up to 0.2.118. The flaw allows the decoder to read beyond its intended buffer boundaries, potentially exposing adjacent process memory such as credentials or logs. This vulnerability does not affect integrity or availability but can lead to information disclosure. It is similar to a previously known issue (GHSA-r5c8-rf4w-qrq8) but distinct in its specifics. No known exploits are reported in the wild, and no official patch or remediation details are provided in the input data.

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. `readUint8Array` never compares the wire-supplied length against the decoder's own view, so one over-long length prefix returns whatever the host process allocated next: other tenants' document content, personal data, and live bearer session tokens**, recovered in full and at will. An attacker who can supply bytes to a lib0 decoder which means any peer that can open a socket, including before authentication reads adjacent process memory and, where the consumer echoes, stores or re-serves the decoded value, receives it back. This is patched in version 0.2.118 and 1.0.0-rc.33.

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.

CVE-2026-85644 is a type confusion vulnerability in XS::Parse::Infix versions 0.40 through 0.49 for Perl. The vulnerability arises because the wrapper function incorrectly checks argument types, leading to dereferencing invalid memory and causing a segmentation fault. This can be triggered by supplying crafted input, such as a number treated as an array reference, potentially allowing an attacker to control memory dereferencing.

CVE-2026-94285 is an out-of-bounds read vulnerability in the byte-oriented codeset parser of libX11 versions before 1.8.14. This flaw could allow a malicious X server to crash connected X clients. The vulnerability has a medium severity rating with a CVSS score of 5.1. No known exploits are reported in the wild. Affected versions include all libX11 releases from 0 up to but not including 1.8.14.

CVE-2026-94284 is an out-of-bounds read vulnerability in the XIM trigger-key registration parser of libX11 versions before 1.8.14. This flaw could allow a malicious X server to cause a crash in attached X clients. The vulnerability has a medium severity rating with a CVSS score of 5.5, primarily impacting availability. No known exploits are reported in the wild. The issue affects libX11 versions from 0 up to but not including 1.8.14.

CVE-2026-94283 is an out-of-bounds read vulnerability in the X Input Method (XIM) attribute parser of libX11 versions before 1.8.14. This flaw could allow a malicious X server to crash connected X clients, causing denial of service. The vulnerability does not impact confidentiality or integrity but affects availability by causing application crashes.

CVE-2026-94282 is an out-of-bounds read vulnerability in the libXi library of x.org, specifically affecting versions before 1.8.4. The flaw occurs in the XI2 enter/leave/focus cookie conversion code and could be exploited by a malicious X server to crash an attached X client. This vulnerability has a medium severity rating with a CVSS score of 5.6.

CVE-2026-92842 is a medium severity heap-based buffer overflow vulnerability in PHP related to the convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode stream filters. The issue arises because the filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value using pestrdup(), which stops at the first NUL byte but retains the original length. This discrepancy allows the filter to read past the allocated buffer when emitting a line break, potentially leaking adjacent heap memory into the output.

CVE-2026-93682 is an out-of-bounds read vulnerability in the PHP HTTP stream wrapper. When following a redirect, if the Location header is empty, the code reads one byte beyond the allocated buffer. This byte influences the redirect target, allowing a malicious server to control whether the client is redirected to the host root or the current directory. The vulnerability has a medium severity with a CVSS score of 5.8.

IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI, causing the web server to crash with possible memory corruption and generate an error log. The ASMI web interface will restart automatically; however, repeated exploitation could result in a sustained loss of access to the ASMI management interface, resulting in an integrity and availability impact.

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established.

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6.

An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client.

An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a

Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers. This issue affects Trusted Firmware: through socfpga_v2.14.0.