CVE-2026-57184 is an out-of-bounds read vulnerability in the Asterisk telephony toolkit's chan_ooh323 addon channel driver. This flaw exists in the Q.931 information-element parser due to insufficient bounds checking. An unauthenticated attacker can exploit this by sending crafted setup packets to cause a crash. The vulnerability affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. The chan_ooh323 driver is not installed by default and requires explicit compilation and a publicly reachable port. Fixed versions are available.
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an empty effective_kernel_shape and indexing it for the input's spatial dimensions. The flaw affects convTransposeShapeInference_opset11() and the current inference path, and an untrusted model that can pass onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service without demonstrated confidentiality or integrity impact. This issue is fixed in version 1.22.0.
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInference_opset1_to_6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The function accesses dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field and terminate an application when onnx.shape_inference.infer_shapes() processes an untrusted model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.
CVE-2026-115680 is an out-of-bounds read vulnerability (CWE-125) affecting Arm Keil MDK-Middleware versions 8.0.0 through 8.3.0. The flaw involves DHCPv6 Option processing, which may lead to over-reads of memory and unintended data retransmission. The vulnerability has a medium severity with a CVSS score of 6.5. No public exploits or patches are currently documented.
CVE-2026-107157 is an out-of-bounds read vulnerability in the Qt Core library's QCborValue::fromCbor() function. It occurs when specially crafted CBOR input is processed, potentially causing application crashes and information exposure. The vulnerability affects Qt versions from 5.12.0 through 6.8.8 and 6.9.0 through 6.11.2. The CVSS 4.0 score is low, reflecting limited impact and high attack complexity. No public exploits or patches are currently documented.
CVE-2026-82947 is a high-severity vulnerability in RT-Labs AB SOEM affecting versions before 2.0.1. It involves out-of-bounds reads caused by improper validation of length and offset values in device messages during frame processing. This flaw can lead to the master reading memory outside allocated buffers, potentially exposing sensitive information or causing application crashes. The issue is fixed in version 2.0.1.
CVE-2026-82943 is an out-of-bounds read vulnerability in RT-Labs AB SOEM affecting versions before 2.0.1. A malicious device can send crafted messages causing the master to read memory beyond intended buffers, potentially exposing up to 64KB of sensitive data. The issue arises because the software does not validate length values from device responses against actual buffer sizes.
A high-severity out-of-bounds read vulnerability exists in the odhcpd DHCPv6 IA parser used by OpenWrt. Versions from 17.01.0 up to but not including 25.12.3 improperly handle IA_NA or IA_PD options with bodies shorter than expected, leading to reading adjacent stack memory. This can disclose sensitive stack data such as stack canaries and ASLR-related information. The issue is fixed in version 25.12.3.
A critical out-of-bounds read and write vulnerability affects the Pillow Python imaging library versions 11.0.0 up to but not including 13.0.0. The flaw arises from multi-frame image loaders reusing stale native storage without verifying mode and size consistency, leading to memory corruption. Crafted image frames in PSD, MPO, DCX, or MIC formats can trigger crashes and, in some cases, command execution. This vulnerability is fixed in Pillow version 13.0.0.
CVE-2026-96644 is an out-of-bounds read vulnerability in the python-pillow Pillow library affecting Windows builds. It arises from improper handling of EMF and WMF image dimensions, where 32-bit dimensions are truncated to 16-bit fields for allocation but used fully for copying data, causing a heap over-read. This can lead to memory disclosure or application crashes when processing crafted metafiles. The flaw is fixed in Pillow version 13.0.0.
CVE-2026-114124 is an out-of-bounds read vulnerability in the Electron framework affecting macOS offscreen rendering. The main process did not fully validate frame data received from the GPU process, allowing a compromised GPU process to cause out-of-bounds memory reads. This could lead to memory disclosure or application crashes. The issue is fixed in Electron versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.
CVE-2026-114122 is an out-of-bounds read vulnerability in the Electron framework affecting versions prior to 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9. The flaw arises from insufficient validation of frame data received from the GPU process in webContents.beginFrameSubscription. An attacker with prior code execution in the GPU process could exploit this to cause the main process to read memory out-of-bounds, potentially disclosing memory contents or crashing the application. The issue is fixed in the specified patched versions.
CVE-2026-102486 is an out-of-bounds read vulnerability in NTPsec ntpd versions 1.1.4 through 1.2.5. It occurs during parsing of NTS extension fields when processing an oversized nonce length in the NTS Authenticator and Encrypted Extension Fields (AEEF). This flaw allows a remote attacker to crash the ntpd daemon, resulting in a denial of service.
CVE-2026-102485 is an out-of-bounds read vulnerability in the Motorola Oncore refclock driver of NTPsec ntpd versions before 1.2.6. An attacker controlling the GPS receiver's serial data can exploit this flaw by sending a PPS Control reply with an out-of-range mode byte, potentially causing the ntpd process to crash or disclose memory contents.
CVE-2026-87849 is an out-of-bounds read vulnerability in Apache bRPC versions prior to 1.18.0. The issue arises because the Discovery naming-service reply parser uses RapidJSON object-only accessors on JSON values without verifying they are objects. Malformed Discovery responses with non-object entries can cause the bRPC client to read memory out of bounds and potentially crash. The vulnerability is fixed in version 1.18.0 by adding validation checks on JSON data before access.
CVE-2026-79704 is an out-of-bounds read vulnerability in Apache bRPC versions 1.11.0 through 1.17.0. It occurs in the streaming RPC client when handling multiple streams in a single RPC. A malicious or compromised server can send a malformed response with fewer extra_stream_ids than expected, causing the client to read beyond the bounds of the returned list. This can lead to client process crashes (denial of service) or unintended memory disclosure. The issue is fixed in version 1.18.0.
CVE-2026-61916 is an out-of-bounds read vulnerability in Apache bRPC versions before 1.18.0 on platforms where plain char is unsigned, such as ARM64. The flaw occurs in URL parsing and case-insensitive header lookup due to improper handling of high-bit bytes, allowing remote attackers to cause a process crash and denial of service by sending crafted input. The issue does not affect builds where plain char is signed, such as x86_64. The vulnerability is fixed in Apache bRPC version 1.18.0.
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.
Root Cause:
The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.
Affected Scenarios:
Apache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.
How to Fix:
(Choose one of the following options)
1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3325
Note:
The fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.
Eclipse OpenJ9 versions prior to 0.63.0 contain a vulnerability in the JITServer component that allows unauthenticated remote attackers or malicious JITServers to cause out-of-bounds heap reads. This flaw leads to immediate crashes of the JITServer daemon or client JVM process via segmentation faults, resulting in denial of service.
Eclipse OpenJ9 versions prior to 0.63.0 contain an integer underflow vulnerability in the JITServer component during DataDescriptor message deserialization. An unauthenticated remote attacker can exploit this by sending a crafted network payload that triggers an unsigned integer underflow, leading to an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing denial of service.