CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-75146 is an out-of-bounds read vulnerability in FFmpeg's DASH demuxer. It occurs when a live DASH manifest is refreshed with a startNumber lower than the previous one, causing the sequence number to become negative. This negative index is then used to access the fragments array without proper lower bound checks, leading to an out-of-bounds read. This can be triggered by a malicious or misconfigured DASH server serving a manifest with a decreasing startNumber.

An out-of-bounds read vulnerability (CWE-125) exists in the SWTPM_NVRAM_CheckHeader() function of swtpm due to a size mismatch between a pointer and a structure. This flaw could lead to memory safety issues and has been assigned a medium severity with a CVSS score of 6.1. Multiple specific versions of swtpm are affected. No information about available patches is provided.

CVE-2026-58087 is an integer underflow vulnerability in FreeBSD's semctl(2) system call affecting the GETALL and SETALL commands. The flaw arises due to sequence number wrapping after 0x8000 create/destroy cycles of semaphore sets, allowing an attacker to bypass validation and cause out-of-bounds reads and writes on kernel heap memory. This can be exploited by an unprivileged local user to potentially escalate privileges. The vulnerability affects FreeBSD versions 14.4-RELEASE, 15.0-RELEASE, and 15.1-RELEASE. It has a high severity rating with a CVSS score of 7.8. No patch information is provided in the input data.

CVE-2026-62291 is a medium severity vulnerability in strukturag's libheif (version 1.23.0 and earlier) involving an out-of-bounds read and write caused by inconsistent handling of auxiliary alpha plane dimensions during image decoding and encoding. This flaw can lead to heap corruption when processing crafted image sequences with mismatched primary and auxiliary plane sizes. The issue is fixed in libheif version 1.23.1.

CVE-2026-62292 is a high-severity out-of-bounds read vulnerability in the strukturag libheif library, affecting versions from 1.19.0 up to but not including 1.23.1. The flaw occurs when decoding a crafted uncompressed HEIF image with generic zlib unci full-item compression, specifically when decoding the last advertised tile. An integer overflow in tile offset calculation bypasses bounds checks, causing an invalid memory read and potential application crash. The issue is fixed in version 1.23.1.

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry contains a malformed coordinate. The coordinate parser in `adagucserverEC/CConvertGeoJSON.cpp` indexes `pt.u.array.values[0]` and `pt.u.array.values[1]` and uses `polygon.u.array.length` as a loop bound without first validating the JSON node type or the coordinate length. A coordinate that is an empty array, a one-element array, a scalar, or `null` leads to an out-of-bounds heap read or a NULL pointer dereference. The same unchecked pattern is present in four geometry branches: `Polygon`, `LineString`, `MultiLineString` and `MultiPolygon`. The vulnerable parser runs whenever the server processes a local GeoJSON file, either a configured GeoJSON dataset or a GeoJSON file exposed through the `AutoResource` feature and requested by an unauthenticated WMS request. A crafted GeoJSON file reliably crashes the backend process that handles that request. Version 7.2.2 patches the vulnerability.

A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior to version 26.1.2. Insufficient validation of input processed by the component may result in memory being accessed outside its intended bounds.

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.

CVE-2026-18020 is an out-of-bounds read vulnerability (CWE-125) affecting IBM i versions 7.3, 7.4, 7.5, and 7.6. The flaw is caused by an off-by-one error in bounds checking, which could be exploited by a remote attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but can affect availability. The CVSS score is 5.3, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability due to an out-of-bounds read that could allow a remote attacker to obtain sensitive information. The vulnerability is identified as CWE-125 and has a CVSS 3.1 base score of 5.3, indicating medium severity. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.

CVE-2026-17226 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves an out-of-bounds read that could allow a remote authenticated attacker to access sensitive information or cause a denial of service. The vulnerability requires low attack complexity and no user interaction. No official patch or remediation guidance is currently confirmed.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

CVE-2026-16878 is an out-of-bounds read vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It allows a remote authenticated attacker to obtain sensitive information. The vulnerability has a medium severity with a CVSS score of 5.4. No official patch or remediation guidance has been provided yet.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

CVE-2026-16859 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 that allows a remote attacker to obtain sensitive information due to an out-of-bounds read.

CVE-2026-16853 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 that allows a remote attacker to perform an out-of-bounds read, potentially exposing sensitive information. The vulnerability does not require privileges or user interaction and impacts confidentiality and availability. No official patch or remediation guidance has been provided yet.

ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash.

A vulnerability in GStreamer gst-plugins-good (avidemux) allows out-of-bounds reads due to incorrect calculation of available video field descriptors in AVI parsing. This flaw can cause application crashes (denial of service) when processing crafted AVI files. The issue is fixed in gst-plugins-good version 1.28.6 and addressed in Red Hat Enterprise Linux 10 updates.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive information due to an integer underflow.

CVE-2026-19643 is an out-of-bounds read vulnerability in the Base64 decoder of the AWS aws-sdk-cpp library before version 1.11.862. This flaw can cause a remote authenticated user to crash an application processing crafted Base64-encoded input. The issue affects some platforms and results in denial of service due to application crashes. AWS has released version 1.11.862 to remediate this vulnerability.