CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-73261 is a high-severity vulnerability in the cesanta mongoose embedded web server and network library. Versions prior to 7.23 improperly validate TCP options in the built-in TCP/IP stack, allowing an unauthenticated remote attacker to corrupt the per-connection Maximum Segment Size (MSS) value. This corruption causes mg_send() calls to send truncated or zero-length payloads despite the TCP connection appearing healthy. The issue is fixed in version 7.23.

Mongoose versions prior to 7.23 contain an out-of-bounds read vulnerability in the built-in TLS certificate parser. This occurs because the parser fails to verify that a long-form DER element length fits within the remaining certificate buffer, allowing a peer-controlled length to cause invalid memory access during TLS handshake. An unauthenticated malicious TLS server or a client presenting a certificate can trigger this, resulting in denial of service. The issue is fixed in version 7.23.

CVE-2026-73252 is an integer underflow vulnerability in the cesanta mongoose embedded web server's built-in TLS stack prior to version 7.23. The flaw allows a malicious TLS peer to send a specially crafted TLS 1.3 record that triggers a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service. This occurs because the length calculation underflows, leading to processing of stale buffer contents as trusted data. The issue is fixed in version 7.23.

CVE-2026-106464 is a high-severity vulnerability in Eclipse ThreadX NetX Duo up to version 6.5.2.202603. The NetX Secure X.509 parser improperly handles certificates with an empty BIT STRING signature, causing it to record an invalid signature length (0xFFFFFFFF). This leads to an out-of-bounds read during TLS handshake signature verification, potentially causing a fault.

CVE-2026-102056 is a high-severity out-of-bounds read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated attacker on an adjacent network can send a crafted CFM message to a configured interface, causing the daemon to crash and potentially disclose limited process memory. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS 3.1 base score is 7.1, indicating a high impact primarily due to availability disruption and limited confidentiality loss.

CVE-2026-101946 is an out-of-bounds read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an adjacent low-privilege attacker to disclose limited memory from the rpd process and disrupt an LDP adjacency using an IPv6 LDP message. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS score is 3.5, indicating a low severity impact with limited confidentiality impact and no integrity or availability impact.

CVE-2026-84420 is an out-of-bounds read vulnerability in Citrix Workspace app for Windows. It affects versions before 2603.20 CR, before LTSR 2607, and before LTSR 2507 CU3. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.8. No patch or remediation information is provided in the available data.

Adobe Bridge contains an out-of-bounds read vulnerability (CWE-125) that could allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects multiple versions up to 16.0.7 and 15.1.8. The CVSS 3.1 base score is 5.5, indicating medium severity. No known exploits are reported in the wild, and no patch information is provided.

CVE-2026-88086 is an out-of-bounds read vulnerability in Microsoft SQL Server 2019 (GDR) that allows an unauthorized attacker to disclose information over an adjacent network. The vulnerability affects multiple versions of SQL Server 2019 and later, with official fixes available. The CVSS score is 5.3, indicating a medium severity impact primarily on confidentiality. No known exploits are reported in the wild.

CVE-2026-85888 is an out-of-bounds read vulnerability in Microsoft SQL Server 2017 (GDR) that allows an authorized attacker to disclose information over a network. The flaw affects multiple versions of SQL Server 2017 and later, with patches available in specific fixed releases. The vulnerability has a high severity rating and requires authorized privileges to exploit.

CVE-2026-88081 is an out-of-bounds read vulnerability in Microsoft SQL Server 2017 (GDR) that allows an authorized attacker to disclose information over a network. The flaw affects multiple versions of SQL Server 2017 and later branches, with fixes available in specific updated releases. The vulnerability has a high severity rating with a CVSS score of 7.7 and requires low attack complexity with privileges required but no user interaction. Microsoft has issued official fixes for the affected versions.

CVE-2026-67628 is an out-of-bounds read vulnerability in Microsoft SQL Server 2017 (GDR) that allows an authorized attacker to disclose information over a network. The flaw affects multiple versions of SQL Server 2017 and later branches before specific fixed releases. The vulnerability has a medium severity rating with a CVSS score of 4.9. Microsoft has released official fixes for all affected versions.

Adobe Substance 3D Designer contains an out-of-bounds read vulnerability that may allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability is rated medium severity with a CVSS score of 5.5.

Adobe Substance 3D Designer contains an out-of-bounds read vulnerability (CWE-125) that could allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability has a medium severity rating with a CVSS score of 5.5. No patch or remediation information is currently provided.

Adobe Substance 3D Sampler contains an out-of-bounds read vulnerability (CWE-125) that may allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 6.0.3. The CVSS 3.1 base score is 5.5, indicating a medium severity impact focused on confidentiality. No known exploits are reported in the wild, and no patch information is currently provided.

Adobe Substance 3D Sampler contains an out-of-bounds read vulnerability (CWE-125) that may disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 6.0.3. The CVSS 3.1 base score is 5.5, indicating medium severity. No known exploits are reported in the wild, and no official patch information is provided.

Adobe Substance 3D Stager contains an out-of-bounds read vulnerability (CWE-125) when parsing specially crafted files. This flaw could allow an attacker to read memory beyond allocated bounds, potentially leading to code execution under the current user's privileges. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS score is 7.8, indicating high severity.

Adobe Substance 3D Stager contains an out-of-bounds read vulnerability (CWE-125) when parsing specially crafted files. This flaw can cause the application to read beyond allocated memory, potentially allowing an attacker to execute code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS 3.1 base score is 7.8, indicating high severity.

Adobe Substance 3D Stager contains an out-of-bounds read vulnerability (CWE-125) that may allow an attacker to disclose sensitive memory contents. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS score is 5.5 (medium severity), indicating a moderate risk primarily impacting confidentiality without affecting integrity or availability.

Adobe Substance 3D Stager contains an out-of-bounds read vulnerability (CWE-125) when parsing specially crafted files. This flaw can lead to reading beyond allocated memory, potentially allowing an attacker to execute code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS 3.1 base score is 7.8, indicating high severity.