FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, udptl_rx_packet() used a peer-controlled FEC entry count directly to fill five-entry FEC arrays in a mod_spandsp T.38 session. A larger count wrote sender-controlled error-recovery data beyond those arrays and persisted the oversized count for a later reconstruction pass. Any peer able to deliver UDPTL to an established T.38 fax session can reach the parser, including deployments using fax applications or a T.38 gateway. The memory corruption can crash FreeSWITCH and end every active call, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1.
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.
CVE-2026-65165 is a medium severity vulnerability in NVIDIA Slurm where improper validation of an array index allows a user to manipulate the nodelist with the --distribution=arbitrary option. This manipulation can grant access to compute nodes outside the user's allocated job resources.
Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.
CVE-2026-107457 is a low-severity memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. It occurs under certain MQTT 5 connection settings between client and server and may cause application crashes due to out-of-bounds writes.
CVE-2026-119299 is an out-of-bounds read vulnerability in the gopacket library prior to version 1.7.2. It affects the SCTP chunk chain decoding in layers/sctp.go, where attacker-controlled lengths and counts are passed to sub-decoders without proper bounds checking. This can cause out-of-bounds or inverted slice panics, potentially terminating applications that disable decode recovery or have specific panic handling enabled. The vulnerability impacts availability only and does not lead to data disclosure or modification. The issue is fixed in gopacket version 1.7.2.
MariaDB Connector/J versions from 3.0.0 up to but not including 3.3.7 and from 3.4.0 up to but not including 3.4.5 contain an improper validation of array index vulnerability during caching_sha2_password authentication. A malicious or compromised server or a man-in-the-middle attacker could exploit this by sending a malformed authentication-more-data response that causes excessive memory allocation or an unhandled ArrayIndexOutOfBoundsException. This issue has been fixed in versions 3.3.7 and 3.4.5.
CVE-2026-93862 is an out-of-bounds read vulnerability in the FireCluster Sync processing of WatchGuard Fireware OS. An attacker on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, can exploit this flaw by sending specially crafted network traffic to repeatedly crash the cluster synchronization process. This results in a sustained denial of service condition. The vulnerability affects multiple versions of Fireware OS prior to fixed releases. A high severity rating is assigned based on the CVSS 4.0 score of 7.2.
A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial of service condition and potentially execute arbitrary code as an unprivileged process by sending a specially crafted request.
CVE-2026-116590 is a vulnerability in xerial's snappy-java prior to version 1.1.10.9. It involves improper validation of array indices in the Snappy.arrayCopy method, which allows out-of-bounds reads or writes due to unchecked negative or oversized offset and byteLength values. This can cause JVM crashes. The issue affects methods that pass caller-controlled ranges to native memcpy, including SnappyOutputStream.rawWrite and SnappyInputStream.rawRead. The vulnerability is fixed in version 1.1.10.9.
A vulnerability in go-jose prior to version 4.1.5 allows a denial of service via improper validation of array index during decryption of untrusted JWE ciphertext using certain CBC-HMAC content-encryption algorithms. Specifically, an empty ciphertext buffer can be passed to the unpadding function, causing a panic and service disruption. This issue is fixed in version 4.1.5.
vLLM versions prior to 0.32.0 contain an improper validation of array index vulnerability in the tokenization process. Specifically, an off-by-one error allows a pre-tokenized prompt ID equal to the vocabulary size to bypass validation, leading to a CUDA device-side assertion failure and engine termination. This issue is fixed in version 0.32.0.
CVE-2026-82947 is a high-severity vulnerability in RT-Labs AB SOEM affecting versions before 2.0.1. It involves out-of-bounds reads caused by improper validation of length and offset values in device messages during frame processing. This flaw can lead to the master reading memory outside allocated buffers, potentially exposing sensitive information or causing application crashes. The issue is fixed in version 2.0.1.
SOEM versions before 2.0.1 have an out-of-bounds write vulnerability during device configuration. The software writes configuration data to a fixed-size array without verifying the index against the maximum allowed size (EC_MAXFMMU). A malicious device presenting more configuration blocks than EC_MAXFMMU can cause memory corruption by writing beyond the array boundary, potentially disrupting subsequent operations.
CVE-2026-89319 is a medium severity vulnerability in Eclipse KeyPont - GOSE where the function JweDirectDecryptorBlock.Decrypt improperly validates a 64-bit plaintext length read from a protected header field. This can cause panics due to truncated or oversized values, leading to unbounded memory allocation or slice-bounds errors. The issue affects versions from 0.9.0 up to 1.0.0-rc1 and is fixed in version 1.0.0-rc1.
Velneo vServer versions 36.0 up to but not including 36.6, and 37.0 up to but not including 37.2, contain an improper validation of array index vulnerability (CWE-129). This flaw could allow an attacker to cause unexpected behavior due to invalid array indexing. The vulnerability has a high severity score of 8.7. Fixed versions are 36.6 and 37.2.
CVE-2026-103672 is a high-severity vulnerability in the HMS Networks PEAK-System Device Driver Setup. It involves improper validation of an array index where the device driver uses an attacker-controlled DLC value to index a length table without enforcing an upper bound check (DLC <= 0x0f). This leads to copying attacker-controlled payload data into a fixed-size stack buffer, potentially causing memory corruption.
`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.
The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller, so the loader corrupts its own arena. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.
Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.