CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-88054 is an out-of-bounds read vulnerability in the tesseract-ocr engine versions 5.5.3 and earlier. It occurs when a crafted .traineddata model with a zero-length stack for certain network layers is processed, leading to a dereference of an invalid pointer and a deterministic crash causing denial of service. No patch or fixed release is currently available.

CVE-2026-88048 is a high-severity vulnerability in the open source OCR engine Tesseract, affecting version 5.5.3 and earlier. The flaw arises from improper validation of deserialized layer scalars in the FullyConnected::DeSerialize function, leading to inconsistent dimensions used during matrix operations. This can cause heap out-of-bounds reads and writes, resulting in heap corruption, crashes, information disclosure, or potentially controlled memory corruption. No official fix or patch is available as of the latest review.

CVE-2026-42806 is an out-of-bounds read vulnerability in the Bosch Sensortec BME690 SensorAPI (C-driver) versions 1.0.1 through 1.0.3. The flaw occurs in the read_all_field_data function where the gas_index value is not properly validated, allowing an attacker or compromised peripheral to cause the driver to read beyond a stack buffer. This can lead to corrupted sensor measurements or leakage of adjacent stack memory when the data is logged or transmitted.

CVE-2026-87875 is a heap out-of-bounds read vulnerability in the cupsUTF32ToUTF8() function of the CUPS printing system as shipped in Red Hat Hardened Images and other Red Hat products. The flaw arises because the function lacks a source-length bound and can read past the end of the source buffer when processing SNMP supply-description data. This vulnerability allows an attacker on the adjacent network to cause a limited disclosure of adjacent heap memory. There is no impact on integrity or availability. Red Hat has released an update for Red Hat Hardened Images to address this issue.

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS `DATA_FRAG` submessages. An attacker can craft a `DATA_FRAG` with a large `sampleSize` but a small actual payload, and set `fragmentsInSubmessage` such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes `incoming_length` based on `sampleSize` and calls `memcpy()` without validating `incoming_data.length >= incoming_length`. As a result, `CacheChange_t::add_fragments()` reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting `CacheChange_t` can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.

CVE-2026-61908 is a low-severity out-of-bounds read vulnerability in Cyrus IMAP before version 3.12.4. It is triggered by a crafted JMAP email-header blob ID that causes the software to read beyond the end of an internal array, potentially exposing adjacent heap memory. The vulnerability requires an authenticated user and has high attack complexity. No user interaction is needed, and no known exploits are reported in the wild.

CVE-2026-87736 is a medium severity vulnerability in the mirage-crypto-ec package for OCaml. It involves an out-of-bounds read when processing compressed elliptic curve public keys. This flaw affects versions prior to 2.3.0 and can cause a denial of service due to application crashes but does not impact confidentiality or integrity.

CVE-2026-81646 is an out-of-bounds read vulnerability in the graphics module of Huawei HarmonyOS version 6.1.0. Exploitation may impact system availability and cause limited confidentiality and integrity loss. The vulnerability has a medium severity with a CVSS score of 5.9.

OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability.

A vulnerability (CVE-2026-86564) was identified in the DPDK lib/vhost component involving missing length validation before reading command_data in the virtio-net control queue handler. This flaw could lead to a denial of service (DoS) condition. The issue has a low severity rating with a CVSS score of 3.3. Multiple specific versions of DPDK, particularly Ubuntu-packaged versions from 2.0.0 through 25.11.3, are affected. There is no indication of known exploits in the wild. No patch or remediation details are provided in the available data.

Adobe Acrobat contains an out-of-bounds read vulnerability that may allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects certain versions of Adobe Acrobat up to 26.002.21900 and 24.001.30383. The issue has a medium severity rating with a CVSS score of 5.5.

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe Acrobat contains an out-of-bounds read vulnerability (CWE-125) that may allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 26.002.21900 and 24.001.30383. The CVSS score is 5.5, indicating a medium severity level.

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe Acrobat contains an out-of-bounds read vulnerability that may allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects certain versions of Adobe Acrobat up to 26.002.21900 and 24.001.30383. The issue has a medium severity rating with a CVSS score of 5.5.

CVE-2026-66308 is an out-of-bounds read vulnerability in Microsoft Skype for Business Server 2015 CU13. It allows an authorized attacker to cause a denial of service over a network. The vulnerability affects specific versions prior to fixed releases. A patch is available from Microsoft to address this issue.

CVE-2026-83501 is an out-of-bounds read vulnerability in the Windows Virtualization-Based Security (VBS) Enclave component of Microsoft Windows 11 version 23H2. This flaw allows an authorized local attacker to disclose information. The vulnerability affects multiple builds of Windows 11 23H2 prior to specific fixed versions. A patch is available from Microsoft to address this issue.

CVE-2026-85875 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized local attacker to disclose information. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. A patch is available and has been officially released by Microsoft.

CVE-2026-83989 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds. It involves an out-of-bounds read flaw in the Windows Services for NFS ONCRPC XDR Driver. This vulnerability allows an unauthorized attacker to cause a denial of service over a network. Multiple affected Windows 10 versions prior to specific fixed builds are impacted. An official fix is available from Microsoft.