CWE-126 vulnerabilities

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally.

Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.

Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally.

Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.

Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.

Buffer over-read in Desktop Window Manager allows an authorized attacker to disclose information locally.

Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally.

Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.

Transient DOS when processing a continuous receive command with a zero-sized global configuration override.

In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8911.

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8912.

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8913.