CVE-2026-18278 is an out-of-bounds read vulnerability in the Sony XAV-9500ES Bluetooth L2CAP packet handling. It allows network-adjacent attackers who can pair a malicious Bluetooth device to read sensitive information beyond allocated buffers. This flaw arises from improper validation of user-supplied data. The vulnerability has a low CVSS score of 3.5 and does not indicate known exploitation in the wild. It affects version 3.02.0.0 of the Sony XAV-9500ES.
NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.
Libimager Perl versions from 0.45_02 up to but not including 1.035 contain a vulnerability in the tiff_load_ifd function where unchecked start offsets allow reading outside the EXIF block. This can cause the process to crash or expose bytes outside the intended data block when reading attacker-supplied images.
CVE-2026-76929 is an out-of-bounds read vulnerability in the pcapng file parser of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, leading to a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 4.7.
CVE-2026-76882 is an out-of-bounds read vulnerability in the Bluetooth Attribute Protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service. The vulnerability has a medium severity with a CVSS score of 4.7. No known exploits are reported in the wild, and no patch information is provided in the available data.
CVE-2026-76924 is an out-of-bounds read vulnerability in the Kerberos protocol dissector of Wireshark versions 4.4.0 to 4.4.18 and 4.6.0 to 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 5.5. No confirmed exploits are known in the wild. No patch or official fix information is provided in the available data.
CVE-2026-76923 is an out-of-bounds read vulnerability in the Bluetooth HFP Profile protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause Wireshark to crash, leading to a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 5.5.
CVE-2026-17015 is an out-of-bounds read vulnerability in IBM i versions 7.3 through 7.6. It allows a remote authenticated attacker to cause a denial of service and potentially obtain sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.4.
CVE-2026-16707 is an out-of-bounds read vulnerability in IBM PowerVM Hypervisor's service processor mailbox interface. It affects multiple firmware versions and allows an authenticated attacker with service-level access to the Flexible Service Processor (FSP) to read or modify arbitrary Hostboot memory regions. Exploitation compromises the host firmware boot stack and the hypervisor loaded thereafter, impacting confidentiality, integrity, and availability of the managed system.
CVE-2026-16891 is an out-of-bounds read vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a local attacker to read sensitive information from memory. The vulnerability has a low CVSS score of 3.3, indicating limited impact and requiring local privileges to exploit. No known exploits are reported in the wild, and no official patch information is provided.
CVE-2026-17028 is an out-of-bounds read vulnerability (CWE-125) in IBM PowerVM Hypervisor partition firmware affecting certain firmware versions during iSCSI SAN network boot. An unauthenticated attacker on the same network can disrupt the boot process of a partition performing network boot, causing availability impact to that partition only. Other partitions and the managed system remain unaffected.
CVE-2026-16883 is an out-of-bounds read vulnerability (CWE-125) affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a local attacker to read sensitive information from memory. The vulnerability has a medium severity with a CVSS score of 5.5. No public exploits or patches have been indicated in the provided data.
CVE-2026-16866 is an out-of-bounds read vulnerability (CWE-125) affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to cause a denial of service condition. The vulnerability does not impact confidentiality but may affect integrity and availability. The CVSS score is 4.8, indicating a medium severity level.
CVE-2026-16839 is a critical vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves an integer underflow in the IPv4 IP-options parser that could allow a remote attacker to read out-of-bounds memory, potentially exposing sensitive information. The vulnerability has a high CVSS score of 9.4, indicating a severe impact on confidentiality, integrity, and availability.
CVE-2026-16833 is an out-of-bounds read vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to disclose kernel memory. The vulnerability has a medium severity rating with a CVSS score of 5.3. No known exploits are reported in the wild, and no patch or remediation information is currently provided.
IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.
CVE-2026-16828 is an out-of-bounds read vulnerability (CWE-125) in the ASMI web interface of IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. An unauthenticated attacker on the management network can cause the ASMI web server to crash, potentially causing memory corruption and generating error logs. The ASMI web interface restarts automatically, but repeated exploitation may lead to sustained loss of access to the ASMI management interface, impacting system integrity and availability. Hosted partitions are not affected by this vulnerability.
CVE-2026-55192 is a high-severity vulnerability in FreeRDP prior to version 3.27.0. It involves an out-of-bounds read in the H.264 decoder backends, where decoded YUV planes can be smaller than expected, causing memory beyond the decoder-owned planes to be read. This flaw can lead to client memory disclosure or client crashes. The issue is fixed in FreeRDP version 3.27.0.
CVE-2026-55564 is an out-of-bounds read vulnerability in FreeRDP versions prior to 3.27.0. The flaw exists in the glyph_cache_get function, which incorrectly checks an index against cache->number, allowing a malicious RDP server to cause a read beyond the bounds of an array. This can lead to client crashes and potential disclosure of adjacent heap memory. The issue is fixed in FreeRDP version 3.27.0.
CVE-2026-75147 is an out-of-bounds read vulnerability in FFmpeg's AV1 RTP packetizer component. It occurs due to improper bounds checking when processing the OBU size in AV1 RTP packets, leading to a pointer dereference beyond the packet buffer. This flaw affects FFmpeg versions prior to the commit 983dae9. The vulnerability has a medium severity with a CVSS score of 6.9.