A medium-severity out-of-bounds read vulnerability exists in the open-quantum-safe liboqs library versions 0.11.0 through 0.16.0 when built with OQS_ENABLE_SIG_STFL_LMS=ON. The flaw allows reading up to 32 bytes beyond a caller-supplied signature buffer during verification of truncated LMS or HSS-LMS signatures, and up to 8 bytes in public key validation. The read data is only used internally for hashing and is not exposed externally. This can cause a verifier crash and denial of service but does not lead to memory disclosure or acceptance of invalid signatures. The issue is scheduled to be fixed in version 0.17.0.
An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of service via a malformed TDS RPC request to the TDS port (default 1433).
To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.
FastNetMon versions 1.2.9 and earlier contain an out-of-bounds read vulnerability in the sFlow processing code. The function process_sflow_flow_sample() uses an attacker-controlled header_size value without verifying it against the actual buffer size, leading to a possible out-of-bounds read and process crash. This flaw may expose adjacent memory bytes through parsed flow fields. No fixed version is currently available.
FastNetMon versions 1.2.9 and earlier contain an out-of-bounds read vulnerability in the NetFlow v9 collector. The vulnerability arises because the collector calls strlen() on an interface-description field controlled by an attacker without properly bounding the scan to the field's declared length. If the field lacks a null terminator, this can cause reads beyond the buffer, potentially crashing the process and causing denial of service. No fixed release is currently available.
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review.
FastNetMon versions 1.2.9 and earlier contain an out-of-bounds read vulnerability in the live parse_packet() callback function. This occurs because the code does not verify the captured packet length before accessing IP or transport headers, potentially leading to process termination when processing short or malformed packets. No fixed release is currently available.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2.
CVE-2026-116780 is an out-of-bounds read vulnerability in FreeSWITCH prior to version 1.11.2. The flaw occurs in the function switch_event_expand_headers_check() when a positive offset in variable expansion exceeds the variable's length, causing adjacent heap memory to be appended to the expansion result. This can lead to unintended disclosure of sensitive data such as channel variables, credentials, allocator data, and pointer bytes. The vulnerability is exploitable through configuration templates or authenticated Event Socket commands but not through ordinary dialplan slicing. The issue is fixed in FreeSWITCH version 1.11.2.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw, including calls where remote SDP enables video RTCP even though the SIP profile has no explicit RTCP interval configured. The out-of-bounds read can crash FreeSWITCH and terminate every active call, but supplies no write primitive and does not echo the read values to the sender. This issue is fixed in version 1.11.2.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit without checking it against the bytes remaining in the RTMP message. An oversized declared unit underflowed the unsigned remaining-byte counter and advanced the parser beyond its receive buffer, where the next length-prefix read could crash the process. The flaw affects deployments that build and load mod_rtmp and accept video call sessions, commonly on TCP port 1935; placing the call requires a directory login where auth-calls is true, while no credentials are required where auth-calls is absent or false. A remote client can terminate FreeSWITCH and every active call, but the defect supplies no write primitive and memory disclosure has not been demonstrated. This issue is fixed in version 1.11.2.
CVE-2026-76077 is a classic buffer overflow vulnerability in the ASN1SCC ASN.1 compiler for embedded systems, specifically in the XER tokenizer function NT() prior to version 4.7.0.1. The vulnerability arises from copying tag characters into a fixed-size buffer without proper length checks, allowing crafted XER messages to overwrite stack memory, cause crashes, hangs, or potentially enable code execution. This flaw is fixed in version 4.7.0.1.
CVE-2026-75615 is an out-of-bounds read vulnerability in the esa asn1scc ASN.1 compiler for embedded systems. Versions prior to 4.7.0.1 do not properly validate decoded character indices in certain runtime and generated decoder functions, allowing crafted messages to read adjacent static program constants. The vulnerability affects string alphabets whose size is not a power of two; the full 128-character IA5String alphabet is not impacted. This issue is fixed in version 4.7.0.1.
CVE-2026-70660 is an out-of-bounds read vulnerability in the leejet stable-diffusion.cpp library affecting the safetensors loader. The flaw arises because the loader trusts tensor data_offsets after only verifying that nbytes equals end - begin, allowing a crafted .safetensors file to specify a byte range beyond the file's data section. This can cause the process to read adjacent memory or crash when loading the model. The issue is fixed in commit master-764-e22272e.
CVE-2025-66367 is an out-of-bounds read vulnerability (CWE-125) in the Samsung Semiconductor Exynos 850 chipset. It arises from improper handling of NAS DLTransport messages, which may cause the baseband to crash. A fix was released in July 2026.
CVE-2026-77372 is a high-severity out-of-bounds read vulnerability in VeraCrypt versions prior to 1.26.30 affecting Unix, macOS, and FreeBSD platforms. The flaw arises from improper handling of untrusted length and count values during deserialization in certain source files, leading to heap overflow and potential memory exhaustion. This vulnerability impacts local defense-in-depth boundaries rather than remote attack surfaces and is fixed in version 1.26.30.
Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.
CVE-2026-19319 is an out-of-bounds read vulnerability in IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0. This flaw could allow a remote attacker to obtain sensitive information without requiring authentication or user interaction. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-17493 is an out-of-bounds read vulnerability in IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0. This flaw could be exploited remotely to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but results in service disruption.
An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.