CWE-125: Out-of-bounds Read vulnerabilities

The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic / recv_read_device_identification_res in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id].

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

CVE-2026-69244 is a high severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.3 contain an out-of-bounds heap read in the C response parser during error message construction for malformed HTTP responses. This flaw can be triggered by a malicious or accidental server response, potentially causing a denial of service (DoS) in the client. The issue is fixed in version 3.14.3.

This update for sssd fixes the following issues: Security issues fixed: - CVE-2026-68742: insufficient validation in the NSS responder can lead to an out-of-bounds read and a process crash when a crafted GETHOSTBYADDR request is sent to the NSS responder socket (bsc#1273922). - CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a process crash when a crafted protocol v1 request is processed (bsc#1273925). - CVE-2026-68744: improper memory management in the NSS responder can lead to uninitialized heap memory disclosure from the `sssd_nss` process (bsc#1273924). Other updates and bugfixes: - Add `systemd-tmpfiles` configuration file to populate `/var/lib/sss` with the correct permissions on transactional servers (bsc#1274748).

CVE-2026-20496 is an out-of-bounds read vulnerability in MediaTek chipsets due to a missing bounds check in the geniezone component. Exploitation requires local system privilege but no user interaction. This flaw could lead to local denial of service. The vulnerability affects multiple MediaTek chipset models. No patch or official remediation has been confirmed yet.

CVE-2026-20494 is an out-of-bounds read vulnerability in MediaTek chipsets related to WiFi functionality. The flaw arises from a missing bounds check, potentially allowing local information disclosure if an attacker already has System privileges. Exploitation does not require user interaction. The affected chipsets include MT6890, MT6988, and MT6990. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-20490 is an out-of-bounds read vulnerability in the ccci component of MediaTek chipsets MT6813, MT6986, and MT6988. The flaw arises from a missing bounds check, potentially allowing a local attacker with System privileges to cause a denial of service. Exploitation does not require user interaction. The vulnerability has a medium severity rating with a CVSS score of 4.4.

CVE-2026-20489 is an out-of-bounds read vulnerability in MediaTek chipsets caused by an integer overflow in the display component. It can lead to local information disclosure if an attacker already has System privileges. Exploitation does not require user interaction. The vulnerability affects multiple MediaTek chipset models. The CVSS score is 4.4, indicating medium severity.

CVE-2026-20488 is a medium severity vulnerability in MediaTek chipsets involving an out-of-bounds read in the display component due to a missing bounds check. This flaw can lead to local information disclosure if an attacker already has System privileges. Exploitation does not require user interaction. Multiple MediaTek chipset models are affected. No official patch or remediation details are currently available.

CVE-2026-20479 is a high-severity vulnerability in MediaTek chipsets involving an out-of-bounds read in the modem component due to a missing bounds check. This flaw can be exploited remotely without user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation may result in a denial of service condition. No additional execution privileges are required for exploitation. Multiple MediaTek chipset models are affected.

CVE-2026-63033 is a medium severity vulnerability in MZ Automation's lib60870 library. It involves a heap-based buffer over-read caused by a crafted IEC 60870-5-104 I-frame with an object count that exceeds the ASDU body size. This leads to the InformationObject_ParseObjectAddress function reading one byte beyond the allocated message buffer.

CVE-2026-61893 is a medium severity vulnerability in MZ Automation's lib60870 library version 2.4.0. It involves a heap buffer over-read caused by a crafted IEC 60870-5-104 I-frame with TypeID 104 and an inflated object count, leading the function TestCommand_getFromBuffer to read one byte past the allocated buffer.

CVE-2026-66720 is a medium severity vulnerability in MZ Automation GmbH's libiec61850 library. The flaw exists in the GOOSE subscriber component, which improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE Layer-2 multicast messages. A specially crafted GOOSE frame with an undersized timestamp field can cause a heap out-of-bounds read, leading to a process crash and denial-of-service condition.

CVE-2026-66369 is an off-by-one boundary-handling vulnerability in the GOOSE parser of MZ Automation GmbH's libiec61850 library. It can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus, causing the parser to read beyond the heap buffer. This results in a denial-of-service by terminating the subscriber process. No information about patches or fixes is currently available.

CVE-2026-63550 is a medium severity vulnerability in MZ Automation GmbH's libiec61850 library. It involves a boundary-handling flaw in the MMS BER decoder when processing certain confirmed-request messages. A crafted BER-encoded element can cause the decoder to read beyond heap boundaries, leading to a denial-of-service by terminating the MMS handling process unexpectedly.

CVE-2026-65421 is a medium severity vulnerability in MZ Automation GmbH's libiec61850 library. It involves a flaw in the MMS BER decoder where an attacker-supplied length value for fixed-width BER fields (boolean/integer) is not properly validated. This can cause a read past the end of a heap buffer, leading to the termination of the MMS service process and resulting in a denial-of-service condition.

CVE-2026-66364 is a medium severity vulnerability in MZ Automation GmbH's libiec61850 library. It involves a boundary handling flaw in the GOOSE payload parser that can be triggered by a single unauthenticated Layer 2 multicast frame. The flaw causes an out-of-bounds read by one byte, which reliably terminates the subscriber process and results in a denial-of-service condition. No patch or official remediation has been confirmed yet.

A vulnerability in the MMS server connection handler of MZ Automation GmbH's libiec61850 library causes a heap out-of-bounds read when processing BER-encoded request data with an extended BER tag. This flaw leads to the termination of the MMS service process, resulting in a denial-of-service condition. No patch or official remediation has been confirmed yet.

CVE-2026-56758 is a medium severity vulnerability in MZ Automation GmbH's libiec61850 library. It involves a heap-based buffer over-read in the ACSE layer during MMS connection establishment when parsing the calling AP title with an attacker-controlled length value of zero or one. This flaw can cause the parser to read past the end of a heap buffer, potentially impacting availability.