FreeRDP versions from 3.30.0 up to but not including 3.32.0 contain a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New function. This flaw allows malicious RDP servers to trigger invalid memory reads by sending short clipboard responses, specifically by responding to a FILECONTENTS_SIZE request with fewer than eight bytes when a user pastes a remote file. This can cause the client to crash or corrupt the stream size.
FreeRDP versions from 3.30.0 up to but not including 3.32.0 contain a resource exhaustion vulnerability in the rdpecam client. This flaw allows malicious RDP servers to request unadvertised camera media types with oversized dimensions, causing large memory allocations and reconfiguration of the local camera through the HAL. The vulnerability has a medium severity score of 5.3 and impacts availability without affecting confidentiality or integrity. Fixed versions are available starting from 3.32.0.
FreeRDP versions before 3.32.0 contain a NULL pointer dereference vulnerability in the websocket transport. This flaw allows a malicious gateway to crash FreeRDP clients by sending zero-length ping frames. The vulnerability triggers an assertion failure that terminates the client process, causing a denial of service condition.
FreeRDP versions from 3.0.0 up to but not including 3.32.0 contain an out-of-bounds read vulnerability in the Windows RAIL client. This flaw allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles, potentially causing client crashes or corruption of window titles. The vulnerability is identified as CVE-2026-111375 and has a CVSS score of 9.1, indicating high severity. A patch is available to address this issue.
CVE-2026-111389 is a SQL injection vulnerability in Frappe HRMS affecting versions 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0. The flaw arises from missing input validation in certain endpoints, allowing any authenticated user, even with low privileges, to craft requests that can extract sensitive database information. The vulnerability has a high severity score of 8.3 (CVSS 4.0).
nifticlib through version 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in the function nifti_convert_n2hdr2nim(). This occurs because the NIfTI-2 dim[0] value is not range-checked, allowing attackers to supply a crafted 540-byte NIfTI-2 header via nifti_image_read() that can crash applications or corrupt stack memory. The vulnerability has a CVSS score of 6.1, indicating medium severity.
MP4v2 versions through 2.1.3 have a heap-based out-of-bounds read vulnerability in the MP4File::GetChapters() function. This flaw allows attackers to craft MP4 files with chapter samples shorter than their declared title length, leading to reading beyond allocated heap memory. This can cause application crashes or leak adjacent heap memory into chapter titles, affecting applications like mp4chaps.
libmikmod versions through 3.3.15 have a heap out-of-bounds read vulnerability in the IMF_Load() loader. This flaw allows attackers to craft IMF module files that trigger out-of-range memory reads by enabling the linear-period header flag and mapping notes to samples beyond allocated memory. This causes noteindex indexing past the heap allocation and can crash applications loading such files.
libmikmod versions through 3.3.15 have a global out-of-bounds read vulnerability in the MultiTracker loader function MTM_Load(). This occurs because the module channel count is not properly clamped, allowing a crafted .mtm file with a channel count above 32 to cause out-of-bounds reads. This can corrupt track indices and crash the application loading the module.
WildMIDI versions through 0.5.0 have a heap out-of-bounds read vulnerability in the _WM_ParseNewHmi() function located in src/f_hmi.c. This flaw occurs when handling 0xfe sub-events in HMI files, allowing an attacker to craft a malicious HMI file that triggers reading up to four bytes beyond the allocated buffer. This can cause the decoding application to crash. The vulnerability has a medium severity rating with a CVSS score of 5.5.
EarthScope libmseed versions up to 3.5.4 have a heap out-of-bounds read vulnerability in the ms3_detect() function within parseutils.c. This flaw occurs when processing truncated miniSEED 2 record buffers, allowing an attacker to supply a specially crafted 40 to 47 byte buffer that passes MS2_ISVALIDHEADER to msr3_parse() or ms3_detect(), causing an over-read of up to 8 bytes and potentially crashing the application.
Game Music Emu (libgme) versions through 0.6.5 contain a global out-of-bounds read vulnerability in the Classic_Emu::mute_voices_ function. This flaw allows attackers to crash applications by providing specially crafted NSF files with a voice count exceeding the 16-entry voice-type table, causing a denial of service. The vulnerability is triggered when an NSF header with chip_flags set to 0x3F is opened via gme_open_data or gme_open_file, leading to a read past the static array during loading.
libsidplayfp versions up to 3.1.1 have a heap out-of-bounds read vulnerability. This flaw allows attackers to crash applications by providing a specially crafted PSID/RSID file with an unchecked data offset that causes the function resolveAddrs() to read memory beyond the allocated heap buffer.
Libyal libesedb versions up to 20260704 contain a heap out-of-bounds read vulnerability in the function libesedb_record_get_multi_value(). This flaw allows attackers to read beyond allocated buffers by exploiting unbounded multi-value offset tables. A crafted ESE/EDB database processed by the esedbexport tool can cause the application to crash or expose approximately 32 KiB of adjacent heap memory. The vulnerability has a CVSS score of 6.1, indicating medium severity, with local attack vector and user interaction required.
Zziplib versions through 0.13.80 contain an out-of-bounds read vulnerability in the zzip/mmapped.c file. This flaw allows attackers to craft a malicious ZIP central directory that causes the function zzip_disk_entry_strdup_name to read beyond the intended buffer, potentially crashing the application. The vulnerability has a medium severity rating with a CVSS score of 5.5.
zziplib versions through 0.13.80 have an out-of-bounds read vulnerability in the __zzip_parse_root_directory() function within zzip/zip.c. This flaw occurs due to an ineffective bounds check when processing crafted ZIP files with entry names ending at the central directory end, causing 28-byte ZIP64 extra field over-reads. Exploitation can crash the affected process.
libsmi versions through 0.5.0 have an out-of-bounds write vulnerability in the smiValueAsString() function. This flaw allows attackers to overflow a fixed 1024-byte static buffer by supplying a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets starting with a 0x00 byte. The overflow can corrupt adjacent library globals and cause crashes in smidump or other consumers.
libInstPatch versions through 1.1.7 have a heap out-of-bounds write vulnerability in the SoundFont 2 loader. The function ipatch_sf2_gen_is_valid() fails to properly range-check generator IDs, allowing crafted SF2 files with out-of-range generator IDs to corrupt heap memory. This can cause crashes in Swami or other software using libInstPatch.
libfwsi through version 20260522 contains a heap out-of-bounds read vulnerability in the function libfwsi_mtp_volume_values_read_data(). This flaw allows attackers to read beyond buffer boundaries by crafting MTP volume shell items embedded in .lnk files, jump lists, or shell bags. Specifically, attackers can embed a shell item of 10 to 53 bytes with an item data size of 44 or more to cause a crash in processes consuming these items. The vulnerability has a medium severity with a CVSS score of 6.1.
A heap out-of-bounds read vulnerability exists in libfwsi through version 20260522 in the function libfwsi_mtp_file_entry_values_read_data(). This flaw allows attackers to read memory beyond buffer boundaries by crafting MTP file entry shell items embedded in .lnk files, jump lists, or shell bags. The vulnerability can cause crashes in applications using libfwsi. The CVSS 3.1 base score is 6.1, indicating medium severity with local attack vector and user interaction required.