CVE-2026-119338 is a medium severity vulnerability in the Tesseract OCR engine versions 5.4.0 up to but not including 5.5.4. The flaw involves an out-of-bounds read and double free/use-after-free conditions in the AppendLinePolygon function when processing right-to-left text such as Hebrew or Arabic. This leads to corrupted coordinate data being used internally. The issue is fixed in version 5.5.4.
CVE-2026-119299 is an out-of-bounds read vulnerability in the gopacket library prior to version 1.7.2. It affects the SCTP chunk chain decoding in layers/sctp.go, where attacker-controlled lengths and counts are passed to sub-decoders without proper bounds checking. This can cause out-of-bounds or inverted slice panics, potentially terminating applications that disable decode recovery or have specific panic handling enabled. The vulnerability impacts availability only and does not lead to data disclosure or modification. The issue is fixed in gopacket version 1.7.2.
CVE-2026-61627 is a high-severity out-of-bounds read and write vulnerability in libass, a subtitle renderer for ASS/SSA subtitle formats. Versions prior to 0.17.5 can overread and overwrite the glyph array during rendering of specially crafted subtitle content. This occurs in wrap modes other than two when a line ends with a literal backslash-n sequence and consists only of such sequences or spaces, causing loops to overshoot the glyph array by one. The vulnerability can lead to denial of service, with broader exploitation considered theoretical and constrained by memory protections. The issue is fixed in libass version 0.17.5.
MariaDB Connector/J versions from 3.0.0 up to but not including 3.3.7, 3.4.5, and 3.5.11 contain an out-of-bounds read vulnerability in the decoding of certain server packets. This flaw allows a malicious or compromised server, or a man-in-the-middle attacker, to cause exceptions that terminate connection handling. The issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
CVE-2026-9535 is an out-of-bounds read vulnerability in the vtkChacoReader InputGraph2 functionality of vtk version 9.6.1. This flaw allows an attacker to trigger an out-of-bounds read by providing a specially crafted chaco file. The vulnerability has a high severity score of 8.2 and can cause a denial of service due to application crash.
Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later block processing causes memory corruption. The C++ API and normally used C API modes such as CBC and CTR are unaffected. This issue is fixed in version 3.13.0.
CVE-2026-90869 is an out-of-bounds read vulnerability in Progress Software WS_FTP Server that affects versions prior to 2024.0.7 and 2025.0.4 on Windows. A remote attacker who knows a valid account's enrolled SSH public key can exploit this flaw to terminate the shared SSH service, causing a denial of service. The vulnerability has a high severity rating with a CVSS score of 7.5 and does not impact confidentiality or integrity, only availability.
CVE-2026-115795 is an out-of-bounds read vulnerability in RT-Labs P-Net versions before 1.0.3. The flaw occurs because the software does not verify the presence of a complete block header before reading the next block in DCP Set and Identify requests. This can lead to reading beyond the receive buffer or processing blocks with an underflowed length, potentially causing a crash or limited memory disclosure. Exploitation requires adjacent network access.
CVE-2026-111735 is an integer underflow vulnerability in RT-Labs P-Net versions before 1.0.3. The flaw occurs in the pf_cpm_c_data_ind() function when processing a received cyclic data frame in certain states. A crafted short frame causes the offset calculation to wrap around due to 16-bit arithmetic without proper length checks, leading to out-of-bounds reads. This can result in a crash (denial of service) or memory disclosure.
CVE-2026-111734 is an out-of-bounds read vulnerability in RT-Labs P-Net before version 1.0.3. The issue arises because the function pf_eth_recv() does not properly validate the length of received Ethernet frames before reading the EtherType, VLAN tags, and PROFINET FrameID. A specially crafted truncated frame or a frame consisting solely of VLAN tags can cause the function to read beyond the buffer boundary, potentially leading to a crash or memory disclosure.
CVE-2026-115942 is a high-severity vulnerability in Apache Qpid Proton C up to version 0.40.0. It involves a stack read overflow caused by a misconfigured wildcard TLS certificate that does not comply with RFC9525. The issue is fixed in version 0.41.1.
CVE-2026-118608 is an out-of-bounds read vulnerability in the Alpine iLX-F511 device's libanwbtstack.so component, specifically in the prh_rfcomm_cc_process_test function. This flaw allows a network-adjacent attacker who can pair a malicious Bluetooth device with the target to potentially disclose sensitive information by reading beyond allocated buffer boundaries. The vulnerability has a low CVSS score of 3.5 and does not indicate direct code execution or availability impact by itself.
CVE-2026-103393 is an out-of-bounds read vulnerability in the VRRP implementation of Juniper Networks Session Smart Router. It allows an attacker with Layer 2 adjacency to read stale memory or cause a system fault by sending a specially crafted VRRPv3 advertisement. The vulnerability affects multiple versions prior to fixed releases. The CVSS score is 4.3, indicating medium severity with no confidentiality or availability impact but potential integrity impact. Fixed versions are available.
CVE-2026-103390 is an out-of-bounds read vulnerability in the HttpParser component of Juniper Networks Session Smart Router and Session Smart Conductor. This flaw allows an attacker to cause a denial of service by sending a specially crafted HTTP request. The issue affects multiple version ranges of the product and has been assigned a medium severity rating with a CVSS score of 5.3. Fixed versions are available.
An out-of-bounds read vulnerability exists in ThorVG versions prior to 1.0.7 in the SFNT/TTF font loader's SfntLoader::gen function. The function reads the first four bytes of the input buffer without verifying its size, which can lead to reading beyond the buffer when loading undersized fonts directly from memory. This may cause application crashes or disclosure of adjacent heap memory. The issue is fixed in version 1.0.7.
CVE-2026-57192 is a medium severity vulnerability in Asterisk's Codec2 decoder that allows an authenticated attacker to cause a heap buffer overflow via an out-of-bounds write triggered by a floor/ceil sample-count mismatch. The attacker must authenticate via SIP and establish a call using Codec2 to exploit this flaw. The issue affects multiple versions of Asterisk prior to fixed releases and requires the codec_codec2 module to be loaded and configured on the target endpoint. Fixed versions are available.
Adobe Substance 3D Painter contains an out-of-bounds read vulnerability that could allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 12.1.5. The issue has a medium severity rating with a CVSS score of 5.5.
CVE-2026-93862 is an out-of-bounds read vulnerability in the FireCluster Sync processing of WatchGuard Fireware OS. An attacker on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, can exploit this flaw by sending specially crafted network traffic to repeatedly crash the cluster synchronization process. This results in a sustained denial of service condition. The vulnerability affects multiple versions of Fireware OS prior to fixed releases. A high severity rating is assigned based on the CVSS 4.0 score of 7.2.
CVE-2026-107472 is an out-of-bounds read vulnerability in the QTextCodec TSCII encoding implementation within the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier). This flaw allows applications converting text to TSCII encoding to read memory beyond the input buffer, potentially causing application crashes or incorrect data interpretation. The vulnerability affects Qt versions from 4.0.0 up to 6.8.8 and from 6.9.0 up to 6.11.2. The CVSS score is 4.3, indicating a medium severity level. No public exploits or patches are currently documented.
CVE-2026-105946 is an out-of-bounds read vulnerability in the QAuthenticator NTLM authentication handling within the Qt Network module. This flaw allows remote attackers to cause a denial of service or potentially obtain sensitive heap memory information by sending a crafted NTLM challenge to applications using QNetworkAccessManager or QTcpSocket for NTLM authentication. The issue affects Qt versions from 6.8.0 up to but not including 6.8.10, and from 6.9.0 up to but not including 6.11.2. Fixed versions are 6.8.10 and 6.11.2.