CWE-125: Out-of-bounds Read vulnerabilities

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system.

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.

Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability.

CVE-2026-79616 is a medium severity vulnerability in Qt affecting versions from 5.10.0 through 6.8.8 and 6.9.0 through 6.11.1. It involves an out-of-bounds read when parsing untrusted SVG path strings in Qt Quick's Context2D.path and PathSvg.path components. The vulnerability has a CVSS 4.0 base score of 0.6, indicating low impact with partial exploitability requiring local privileges and user interaction. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash.

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash.

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash.

Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-77558 is an out-of-bounds read vulnerability in Ubiquiti Inc's Dream Machines UniFi gateway devices. An attacker with network access can exploit this flaw to cause a denial of service (DoS) condition, disrupting device availability. The vulnerability does not impact confidentiality or integrity but affects device availability. It has a high severity score of 7.5. Multiple affected versions exist prior to 5.1.31, 4.0.21, and 5.1.26. No vendor advisory or patch information is provided, so patch status is not confirmed.

CVE-2026-77556 is an out-of-bounds read vulnerability in Ubiquiti Inc's Dream Machines UniFi gateway devices. This flaw allows a network-based attacker to cause a denial of service (DoS) by exploiting the memory access error. The vulnerability does not impact confidentiality or integrity but results in service disruption. It affects multiple versions prior to 5.1.31, 4.0.21, and 5.1.26. No known exploits are reported in the wild. The CVSS score is 7.5, indicating high severity.

CVE-2026-18626 is an out-of-bounds read vulnerability in RTI Connext Professional Core Libraries. It affects multiple versions ranging from 5.0.0 up to but not including certain fixed versions in the 5.x, 6.x, and 7.x series. The flaw allows reading beyond intended buffer boundaries, potentially leading to information disclosure or application instability. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.8. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

CVE-2026-18458 is a medium severity vulnerability in RTI Connext Professional Core Libraries involving out-of-bounds read, incorrect function call arguments, and type confusion. It affects versions 6.1.2.21, 7.3.0 up to but not including 7.3.1.6, and 7.4.0 up to but not including 7.7.0.1. The flaw allows overreading buffers, potentially leading to unauthorized data access or application instability.

CVE-2026-11389 is a medium severity vulnerability in RTI Connext Professional Core Libraries that involves an out-of-bounds read due to function calls with incorrect argument counts and type confusion. It affects versions from 7.4.0 up to but not including 7.7.0.1, and from 7.3.0 up to but not including 7.3.1.6. This vulnerability can cause buffer overread conditions.

CVE-2026-81884 is a medium severity vulnerability in radare2 prior to version 6.2.0. It involves an out-of-bounds read in the Mach-O LC_DATA_IN_CODE parser when processing crafted Mach-O files with the non-default bin.verbose option enabled. This flaw can cause heap memory to be read beyond its allocated buffer, potentially leading to process termination. No memory disclosure or attacker-observable impact has been demonstrated. The issue is fixed in radare2 version 6.2.0.

CVE-2026-81883 is an out-of-bounds read vulnerability in radare2's Lua 5.3 bytecode function parser affecting versions prior to 6.2.0. The parser reads fixed function-metadata fields immediately after a function-name string without verifying buffer boundaries, leading to reads beyond the allocated input buffer. This can cause invalid parsing results or process termination. No memory disclosure or attacker-observable information leak has been demonstrated. The issue is fixed in radare2 version 6.2.0.

CVE-2026-81882 is an out-of-bounds read vulnerability in radare2's binary property-list Unicode parser prior to version 6.2.0. The vulnerability occurs because the parser underallocates an uninitialized UTF-8 destination and does not guarantee NUL termination. Triggered by running the pFB or pFBj commands on untrusted binary property-list data, this causes the JSON encoder to read beyond the allocated buffer, potentially disclosing uninitialized or adjacent heap memory. The issue is fixed in radare2 version 6.2.0.

CVE-2026-81881 is an out-of-bounds read vulnerability in radare2's Mach-O Swift field-metadata parser prior to version 6.2.0. The flaw occurs when a relative Swift field pointer is lower than the field-metadata section base, causing a negative logical index and reading memory before the allocated buffer. This can lead to incorrect metadata processing or process termination, but no memory disclosure has been demonstrated. The issue is fixed in radare2 version 6.2.0.

CVE-2026-81879 is an out-of-bounds read vulnerability in radare2's ELF parser affecting versions prior to 6.2.0. The issue arises from improper handling of the ELF PN_XNUM field, where the program-header array is allocated based on a resolved count but iterated using an original, larger count, leading to heap out-of-bounds reads. This can cause process termination and denial of service. There is no evidence of memory disclosure or code execution exploitation. The vulnerability is fixed in radare2 version 6.2.0.