CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-73462 is an out-of-bounds read vulnerability in Arista Networks EOS affecting the IGMP snooping feature, which is enabled by default on all VLANs. An unauthenticated network-adjacent attacker can send malformed packets to cause the IGMP snooping agent to crash temporarily. This disruption results in multicast traffic being flooded to all ports on the affected VLAN until the service recovers. Repeated exploitation could cause prolonged multicast forwarding issues.

CVE-2026-76151 is an out-of-bounds read vulnerability in the HTTP Cache-Control response header parsing within the QtNetwork module of Qt versions 6.0.0 through 6.8.8 and 6.9.0 through 6.11.1. This flaw allows remote attackers to cause a denial of service (application crash) by sending an excessively large Cache-Control header value from an untrusted or compromised HTTP server to a client application using QNetworkAccessManager. The issue affects only the client side, does not impact 32-bit builds, and involves read-only out-of-bounds access without information disclosure or code execution.

On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.

CVE-2026-92176 is an out-of-bounds read vulnerability in pdfforge PDF Architect version 9.1.77.23081. It arises from improper validation of user-supplied data in the handling of App objects, allowing remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability has a high severity with a CVSS score of 7.8.

Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, leading to a buffer overflow when untrusted files are parsed. The severity assumes surfio is used to parse untrusted files in a networking context such as a web service. This issue is fixed in version 0.0.19.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.

resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes while parsing untrusted GRDECL files in lib/resdata/rd_kw_grdecl.cpp and lib/resdata/rd_grid.cpp. Malformed COORD, ZCORN, CORSNUM, ACTNUM, or MAPAXES data can reach rd_grid_alloc_GRDECL_kw__ with inconsistent lengths, while unbounded floating-point conversion can exceed the intended parser buffer. In a network service that accepts untrusted GRDECL files, these conditions can cause a classic buffer overflow, out-of-bounds reads, invalid array access, NULL pointer dereference, memory corruption, or service termination. This issue is fixed in version 6.2.9.

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.

An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. A malformed Netlink command can trigger an out-of-bounds read, potentially leading to information leakage.

Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Denial of Service via an out-of-bounds memory read during processing of a document file by the antivirus engine.

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, a Time-of-Check Time-of-Use (TOCTOU) race condition leads to out-of-bounds access.

TinyEXIF versions before 1.1.0 contain a heap-based buffer over-read vulnerability in the EntryParser::Fetch methods triggered by a crafted SubjectArea length. This flaw is identified as CWE-125 and can cause a denial of service due to application crash or instability. The vulnerability has a low CVSS score of 2.9 and does not impact confidentiality or integrity.

Out-of-bounds read vulnerability in Citirx Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.

A heap out-of-bounds read vulnerability exists in the cupsUTF32ToUTF8() function of the CUPS printing system due to missing source-length bounds during SNMP supply-description parsing. This vulnerability is tracked as CVE-2026-87875 and affects multiple versions of CUPS included in Red Hat Hardened Images. A security update has been issued by Red Hat to address this issue.

CVE-2026-13326 is an out-of-bounds read vulnerability in Qt NFC's language code length parsing. This flaw allows a physically proximate attacker to cause a denial of service or limited memory disclosure by using a specially crafted NFC tag. The vulnerability affects Qt versions from 5.2.0 up to but not including 6.8.9, and from 6.9.0 up to but not including 6.11.2. It has a CVSS 4.0 score of 6.9, indicating a critical severity level. No explicit patch links are provided in the data, and no known exploits are reported in the wild.

CVE-2026-89160 is an out-of-bounds read vulnerability in PCRE2 versions from 10.34 up to but not including 10.48. It occurs during the PCRE2_MATCH_INVALID_UTF matching process when handling an invalid UTF subject. The vulnerability has a medium severity with a CVSS score of 3.7 and does not impact confidentiality or integrity but may affect availability.

CVE-2026-89156 is an out-of-bounds read vulnerability in the PCRE2 library's pcre2_match function triggered after a JIT fallback when invalid UTF data is provided. PCRE2 is a C library for regular expression matching with separate 8-bit, 16-bit, and 32-bit APIs. This vulnerability affects versions from 10.34 up to but not including 10.48. The CVSS score is 2.9, indicating low severity for this specific issue. Multiple related vulnerabilities in PCRE2 before 10.48 address out-of-bounds reads and writes, integer overflows, and incorrect memory frees. The vendor has fixed these issues in version 10.48.

CVE-2026-16172 is an out-of-bounds heap read vulnerability in the Netskope Endpoint DLP (EPDLP) service. A local standard user can send a specially crafted message that bypasses proper bounds checking, potentially causing the kernel driver handler to crash. Exploitation may lead to temporary interruption of DLP enforcement and could disclose per-boot memory layout information to unauthorized users. The vulnerability affects versions prior to 141.0. The CVSS 4.0 score is 6.0, indicating medium severity.

CVE-2026-49837 is an out-of-bounds read vulnerability in osrg gobgp versions prior to 4.6.0. The issue arises from improper parsing of BGP OPEN capabilities, where the parser may read beyond the declared capability length, potentially causing incorrect interpretation of subsequent capability data. This can affect peer AS validation during BGP session establishment. The vulnerability is fixed in version 4.6.0.