A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.
Xianrui Dong discovered that libheif had an out-of-bounds read in its
HEIF sequence track parser. An attacker could possibly use this issue
to cause a denial of service or obtain sensitive information. This issue
only affected Ubuntu 26.04 LTS. (CVE-2026-47254)
Junyi Liu discovered that libheif had a null pointer dereference in its
image tiling interface. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-47709)
Calvin Young and Enoch Chow discovered that libheif had an integer
overflow in its inline mask size calculation. An attacker could
possibly use this issue to cause a denial of service or obtain sensitive
information. (CVE-2026-47714)
Ariel Koren discovered that libheif had an integer underflow in its
grid image tile coordinate transform. An attacker could possibly use
this issue to cause a denial of service or obtain sensitive information.
(CVE-2026-48029)
It was discovered that libheif had a missing bound check in its HEIF
sequence parser, allowing unbounded heap allocation. An attacker could
possibly use this issue to cause a denial of service. (CVE-2026-50142)
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue.
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decoder_context::decode_slice_unit_WPP()` in `libde265/decctx.cc`. When decoding a WPP (Wavefront Parallel Processing) HEVC slice, `ctbAddrRS` is computed as `ctbRow * ctbsWidth` inside the entry-point loop. If the PPS/SPS headers are crafted so that this value exceeds `pps.CtbAddrRStoTS.size()`, the subsequent array access `pps.CtbAddrRStoTS[ctbAddrRS]` reads past the end of the allocated vector, triggering a heap-buffer-overflow confirmed by AddressSanitizer. Version 1.0.19 patches the issue.
A heap-buffer-overflow read vulnerability exists in libde265 versions prior to 1.0.19 in the function decoder_context::decode_slice_unit_tiles. The issue arises when a malformed PPS encodes geometry inconsistent with the SPS, causing an out-of-bounds read of a 4-byte buffer. This vulnerability has a CVSS score of 6.9 (medium severity). Version 1.0.19 addresses this issue.
Data::DisjointSet::Shared versions before 0.02 for Perl contain an out-of-bounds read and write vulnerability in the dsu_find function. This occurs because the parent index used in dsu_find is not validated against the node count, allowing memory corruption or process crashes. The vulnerability arises despite a header validation step that does not check array contents. A local attacker able to modify the backing file can exploit this to cause memory corruption or crashes.
Data::SpatialHash::Shared versions before 0.02 for Perl contain an out-of-bounds read and write vulnerability due to unvalidated indices in key functions. This allows a local peer with write access to the backing file to corrupt memory or crash the process by manipulating bucket chains and free lists. The vulnerability arises because the validator checks header scalars and region layout but does not validate array contents, leading to unsafe memory access during queries and inserts.
Data::Intern::Shared versions before 0.02 for Perl contain an out-of-bounds read vulnerability in the si_idx_find function. This occurs due to unvalidated indices used for slot, reverse, and arena arrays, allowing reads beyond intended memory bounds. A local attacker who can modify the backing file may exploit this to disclose adjacent process memory. The vulnerability has a critical severity with a CVSS score of 9.1.
Data::RoaringBitmap::Shared versions before 0.02 for Perl contain an out-of-bounds read vulnerability in the rb_contains_locked function. This occurs because the function uses unvalidated container offsets and cardinality values derived from a file, leading to potential memory reads beyond intended bounds. A local attacker able to modify the backing file can exploit this to cause a crash or read adjacent memory.
Data::HashMap::Shared versions before 0.14 for Perl contain a critical out-of-bounds read vulnerability due to unvalidated arena offset and length values in the shm_str_copy function. This flaw allows a local attacker who can write to the backing file to manipulate offsets and lengths, causing memory reads beyond intended bounds or process crashes during certain map operations.
Data::RadixTree::Shared versions before 0.02 for Perl contain an out-of-bounds read vulnerability due to improper validation of node and arena indices in the rdx_find_locked function. This flaw allows a local attacker who can modify the backing file to cause the software to read memory out-of-bounds or crash. The vulnerability arises because the header validation does not verify node records, leading to unsafe indexing into memory-mapped data structures.
Data::SortedSet::Shared versions before 0.03 for Perl contain an out-of-bounds read vulnerability due to insufficient validation of node indices in rank and min/max queries. This can lead to reading adjacent memory or crashing the process when a local attacker manipulates the backing file. The vulnerability arises because only the root index is validated on attach, while other node indices used in queries are not properly bounded. A full structural validation method exists but is not run automatically.
Data::ReqRep::Shared versions before 0.05 for Perl contain an out-of-bounds read vulnerability in the reqrep_recv_locked function. The vulnerability arises because the function copies data using an unvalidated offset and length from a memory-mapped segment, potentially reading adjacent memory or causing a crash. This occurs despite a header validation step that does not verify the array contents used for the copy operation. A local attacker able to write to the backing file can exploit this to trigger the out-of-bounds read.
CVE-2026-16243 is a medium severity vulnerability in Eclipse OMR up to version 0.11 where the arraycmp SIMD implementation for Z and P architectures does not verify if the number of bytes to compare is zero, leading to an out-of-bounds read.
An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.
This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation phase, the parser fails to perform sufficient length validation for the incoming data block. A remote, unauthenticated attacker could potentially exploit this flaw by sending a specially crafted RDP packet containing malformed data. Due to missing bounds checks, the xrdp process may read a small number of bytes beyond the declared data block boundary, potentially disclosing process memory contents that could be combined with other vulnerabilities. This issue has been fixed in version 0.10.6.1.