CWE-126 vulnerabilities

A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information.  See vulnerability B-E4 in the related paper below.

A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below.

Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network.

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally.

Buffer over-read in Windows Wired AutoConfig Service allows an authorized attacker to disclose information locally.

Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network.

Buffer over-read in Windows Win32K allows an authorized attacker to disclose information locally.

Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access.

CVE-2026-25288 is a high severity buffer over-read vulnerability (CWE-126) in Qualcomm Snapdragon products. It causes a transient denial of service (DoS) when processing a short target wake time channel usage response frame with insufficient packet size. The vulnerability affects multiple Snapdragon chipsets and related components. There is no vendor advisory or patch information currently available. The CVSS score is 7.4, indicating a high impact on availability without confidentiality or integrity impact.

Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, unauthenticated attacker could potentially exploit this flaw by sending a specially crafted RDP packet containing malformed capability data. Due to missing bounds checks, the xrdp process may perform out-of-bounds memory reads, which can result in the termination of the service (Denial of Service). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1.

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14.

### Summary Tornado's optional native extension `tornado.speedups` implements `websocket_mask` without validating that the `mask` argument is exactly four bytes long. The C function reads four bytes from `mask` unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory. The behavior is reachable from Tornado's XSRF token decoder when `xsrf_cookies=True` and the native extension is active. ### Mitigations This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).

Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.