CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-12669 is a low-severity vulnerability in IBM MQ Operator that allows an authenticated attacker to trigger a minor out-of-bounds read by sending malformed compressed data. The vulnerability does not disclose data and the request is rejected. It affects multiple versions of IBM MQ Operator prior to 3.4.0, which contains the fix.

CVE-2026-109588 is a numeric truncation error vulnerability in FreeRTOS-Kernel versions 11.3.0 and 11.3.1 on the Arm Cortex-R82 MPU port. This flaw allows an unprivileged task on MPU-enabled builds to potentially read or write privileged kernel memory beyond the intended buffer boundaries via a stream buffer system call. The vulnerability is fixed in version 11.3.2 and later.

CVE-2026-49868 is a critical out-of-bounds read vulnerability in RIOT-OS affecting versions prior to 2026.07. The flaw occurs in the DHCPv6 client implementation where minimum-length validation is missing before parsing IA_PD and IA_NA option bodies. A malicious DHCPv6 server can exploit this by sending a reply with an option length smaller than expected, leading to heap memory reads beyond the option boundary. This can cause device crashes and potential memory exposure or corruption. The issue is fixed in version 2026.07.

CVE-2026-68906 is a high-severity out-of-bounds read vulnerability in the mz-automation libiec61850 library prior to version 1.6.2. It occurs in the parseUserInformation function when handling malformed AARE PDUs during association, leading to an infinite CPU loop or a one-byte out-of-bounds read that can cause process abort. The flaw is due to improper validation of a negative buffer position returned by BerDecoder_decodeLength. This issue is fixed in version 1.6.2.

An out-of-bounds read vulnerability exists in libIEC61850 versions prior to 1.6.2 due to improper argument handling in the checkDataSetAccess function. This leads to reading beyond a stack buffer when processing a remote defineNamedVariableList request, causing potential server crashes and denial of service. The issue is fixed in version 1.6.2.

CVE-2026-102941 is an out-of-bounds read vulnerability in the gomarkdown markdown Go library. It occurs in the parser.IsSafeURL function when slicing a URL without proper length checks, causing a panic on short or malformed URLs. This can lead to a denial of service by terminating the calling process. The issue affects versions prior to 0.0.0-20260724235538-61af6e1e6971 and is fixed in that version.

CVE-2026-105228 is a high-severity vulnerability in Deltaww ISPSoft that allows remote attackers to perform out-of-bounds reads, potentially disclosing sensitive information. It affects versions from 0 up to but not including 3.25. The vulnerability requires no privileges and no user interaction but has low attack complexity. There is no indication of active exploitation in the wild or available patches as of the publication date.

CVE-2026-105227 is a high-severity vulnerability in Deltaww ISPSoft that allows remote attackers to perform out-of-bounds reads, potentially disclosing sensitive information. It affects versions from 0 up to but not including 3.25. The vulnerability requires no privileges and no user interaction, but the attacker must be remote. There is no information about available patches or vendor advisories. No known exploits are reported in the wild.

CVE-2026-108455 is an out-of-bounds read vulnerability in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Official patches have been released to address this issue in specific versions of the software.

CVE-2026-108453 is an out-of-bounds read vulnerability in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity with a CVSS score of 6.5. Official patches have been released to address this issue.

CVE-2026-108436 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Microsoft has released official fixes for affected versions.

CVE-2026-108434 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 6.5. Official fixes have been released in specific versions of the software.

CVE-2026-79843 is an out-of-bounds read vulnerability in Hewlett Packard Enterprise's HPE NonStop SQL/MX EXE component. It occurs when a corrupted file is processed under certain conditions, potentially causing information disclosure, process termination, CPU halt, or data corruption. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No affected versions or patch information are currently provided.

CVE-2026-101290 is a high-severity vulnerability in the SICK AG Sick_Safetyscanners_Base CPP Driver. A remote attacker can send a specially crafted network packet that triggers an out-of-bounds memory read due to improper validation of packet length. This flaw can cause the application to crash, resulting in a denial-of-service condition. No confidentiality or integrity impact is indicated. The affected versions are from 0 up to and including 1.0.4.

CVE-2026-58100 is a race condition vulnerability in FreeBSD's kqueue_fork_copy_knote() function. It occurs because the function indexes the child's file descriptor table using a knote's file descriptor number without performing bounds checking. This can lead to an out-of-bounds read if a concurrent thread in the parent process grows the parent's file descriptor table and registers knotes with file descriptor numbers beyond the child's table size. An unprivileged local user may exploit this race condition to escalate privileges.

CVE-2026-76667 is a medium severity vulnerability in Hewlett Packard Enterprise HPE NonStop EXPAND involving an out-of-bounds memory read. This flaw could lead to integrity and availability impacts but does not affect confidentiality. The vulnerability requires high privileges and local access to exploit, with high attack complexity and no user interaction needed.

CVE-2026-76666 is a medium severity security vulnerability in Hewlett Packard Enterprise's HPE NonStop EXPAND product. It involves an out-of-bounds memory read, classified under CWE-125. The vulnerability requires local access with high privileges and high attack complexity, and does not involve user interaction. Confidentiality impact is high, while integrity impact is none and availability impact is low. No patch or remediation information is currently available.

CVE-2026-76665 is a high-severity vulnerability in Hewlett Packard Enterprise's HPE NonStop EXPAND product. It involves an out-of-bounds memory read that can lead to a buffer overflow condition. The vulnerability is identified as CWE-125. No specific affected versions or patch information are provided. The CVSS 3.1 base score is 7.1, indicating a high impact with local attack vector and high complexity.

CVE-2026-76664 is a medium severity vulnerability in Hewlett Packard Enterprise's HPE NonStop EXPAND product involving an out-of-bounds memory read/write condition. This flaw could potentially allow unauthorized memory access leading to partial confidentiality and integrity loss, as well as high impact on availability. No specific affected versions or patches are currently documented.

CVE-2026-63626 is a heap-based buffer overflow vulnerability in the cesanta mongoose embedded web server and network library. The flaw exists in the ppp_handle_ipv6cp() function prior to version 7.23, where it improperly trusts the 16-bit IPv6CP length field without validating it against the actual payload size. This can allow an unauthenticated adjacent peer on a PPP or PPPoE link to send a malformed Configure-Request with an oversized length, leading to out-of-bounds reads and writes in memory buffers. The issue can also cause exposure of adjacent heap memory or hang the event loop. The vulnerability is fixed in version 7.23.