CWE-126 vulnerabilities

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Memory Corruption when retrieving output buffer with insufficient size validation.

Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.

Cryptographic issue while copying data to a destination buffer without validating its size.

Memory corruption while preprocessing IOCTL request in JPEG driver.

Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 4.3x before 5.1.*.

Memory Corruption when adding user-supplied data without checking available buffer space.

RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service

NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap read in `.NET Single File` bundle header parser due to missing bounds check. Opening a crafted file with NanaZip causes a crash or leaks heap data to the user. Version 6.0.1630.0 patches the issue.

Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.

Transient DOS when processing a received frame with an excessively large authentication information element.

CVE-2025-60003 is a high-severity buffer over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated attacker can exploit this by sending a crafted BGP update containing specific optional transitive attributes over an established peering session, causing rpd to crash and restart, resulting in a denial-of-service (DoS). This vulnerability only triggers if one or both BGP peers are non-4-byte-AS capable, which is not the default behavior unless explicitly disabled. It affects multiple versions of Junos OS and Junos OS Evolved prior to certain patch releases. The vulnerability has a CVSS score of 7.5, indicating high severity, with no known exploits in the wild currently. European organizations using affected Juniper routing devices with BGP peering configurations that disable 4-byte AS support are at risk. Mitigation requires upgrading to fixed Junos OS versions and verifying BGP peer capabilities to avoid triggering the flaw.

Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.

Information disclosure while processing a firmware event.

Transient DOS while parsing video packets received from the video firmware.

pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.