CWE-125: Out-of-bounds Read vulnerabilities

There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data.   This results in a read outside the bounds of an allocated data structure.  Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file.  This issue affects all versions before 2026.0.0.

There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data.   This results in a read a few bytes past the end of an allocated heap buffer during file handling.  Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file.  This issue affects all versions before 2026.0.0.

CVE-2026-84968 is an out-of-bounds read vulnerability in the BSON decoding component of the MongoDB PHP driver. An unauthenticated attacker can supply specially crafted input to trigger this flaw, causing a small amount of adjacent process memory to be copied into an error message returned to the application. This may lead to unintended disclosure of limited memory contents. The vulnerability affects multiple version ranges of the MongoDB PHP driver. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-84270 is an out-of-bounds read vulnerability in the MTP backend of GNOME gvfs. The flaw occurs because the do_read() function trusts the data length returned by a mounted MTP device without limiting it to the requested size. A malicious MTP device can exploit this by returning more bytes than requested, causing a memory read outside intended boundaries and crashing the gvfsd-mtp process. This results in a denial of service when reading files from the device. The issue is fixed in gvfs version 1.60.2.

CVE-2026-82330 is a heap out-of-bounds read vulnerability in the file-pvr plugin of GNOME GIMP. It occurs when processing specially crafted PVR image files due to missing memory bounds checking in the VQ compressed decoder. This flaw can cause application crashes leading to denial of service or limited disclosure of heap memory contents. Exploitation requires convincing a user to open a malicious PVR file, reducing the likelihood of attack. The issue has been rated with moderate severity (CVSS 6.1).

CVE-2026-82328 is a heap out-of-bounds read vulnerability in the file-ico plugin of GIMP. It occurs due to improper validation of the used_clrs (palette count) parameter when processing specially crafted ICO image files. This flaw can cause the application to crash, resulting in denial of service, or potentially disclose limited heap memory contents.

CVE-2026-82324 is a vulnerability in the file-iff (IFF/ILBM) plugin of GIMP that causes heap out-of-bounds reads when processing crafted IFF/ILBM image files. The flaw arises from improper validation of the HAM row size and handling of zero color planes, leading to a row size mismatch that bypasses memory bounds checking. This can cause application crashes resulting in denial of service or limited disclosure of heap memory contents.

A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

Adobe DNG Software Development Kit (SDK) versions 1.7.1 2502 and earlier contain an out-of-bounds read vulnerability that may expose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-71402 is a medium-severity out-of-bounds read vulnerability in the DHCPv4 packet capture code of SUSE wicked up to version 0.6.80. The flaw occurs because the function ni_capture_inspect_udp_header() incorrectly reports the IP total length as the payload length, causing the DHCPv4 client to read up to 68 bytes beyond the end of the packet buffer. An unauthenticated attacker on the same network can send a crafted DHCP/UDP packet to trigger this over-read, potentially causing the client to interpret adjacent heap memory as DHCP options. No memory writes or remote data exfiltration have been demonstrated. No official fix or patch information is currently available.

A vulnerability in the file-xwd plugin of GIMP allows a heap out-of-bounds read when processing specially crafted XWD image files. The flaw arises because the plugin validates image width and bytes-per-line parameters independently, failing to ensure their combined values match the allocated buffer size. This can cause application crashes (denial of service) or limited disclosure of heap memory contents in the processed image. Exploitation requires user interaction to open a malicious XWD file, reducing likelihood of attack. The issue is rated medium severity with a CVSS score of 4.4.

CVE-2026-59981 is an out-of-bounds read vulnerability in the AcademySoftwareFoundation's OpenEXR library affecting versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. The issue arises from the SampleCountChannel::row() API returning an out-of-bounds pointer when handling deep images with a non-zero dataWindow origin. This can cause a crash or potentially leak adjacent heap memory. Fixed versions include 3.2.11, 3.3.13, and 3.4.14.

OpenEXR versions 3.4.0 through 3.4.12 contain an improper input validation vulnerability in the HTJ2K decoder. The decoder fails to verify that a header-length field (PLEN) fits within the available buffer before using it, leading to an out-of-bounds read during decoding of crafted EXR files. This flaw is fixed in version 3.4.13.

CVE-2026-61555 is an out-of-bounds read vulnerability in the AcademySoftwareFoundation's OpenEXR library. It affects versions before 3.2.11, versions from 3.3.0 up to but not including 3.3.13, and versions from 3.4.0 up to but not including 3.4.14. The vulnerability occurs when processing a crafted EXR file with an empty multiView header attribute, leading to an out-of-bounds access in Imf::viewFromChannelName(). This can cause the application to crash. The issue has been fixed in versions 3.2.11, 3.3.13, and 3.4.14. The CVSS score is 5.5, indicating a medium severity impact primarily affecting availability.

OpenEXR, a widely used image format implementation by the AcademySoftwareFoundation, has a heap out-of-bounds read vulnerability on ILP32 builds in versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. The flaw occurs when a specially crafted RLE-compressed EXR file causes a 64-bit unpacked size truncation before allocation, leading to out-of-bounds reads during decoding. This can result in a denial of service. The issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

An out-of-bounds read vulnerability (CWE-125) exists in AcademySoftwareFoundation's OpenEXR library on ILP32 builds. The flaw occurs in versions before 3.2.11, from 3.3.0 up to 3.3.12, and from 3.4.0 up to 3.4.13 when processing crafted uncompressed deep-tile EXR files. This causes a sample-count table size calculation to wrap, leading to denial of service. The issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Adobe Substance3D - Painter contains an out-of-bounds read vulnerability that may disclose sensitive memory contents. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability has a medium severity rating with a CVSS score of 5.5.

Adobe Illustrator Desktop 2026 contains an out-of-bounds read vulnerability that may allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability does not allow code execution or denial of service but can lead to information disclosure.