Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
4528 vulnerabilities reference this CWE, most recent first.
CVE-2026-112276 (GCVE-0-2026-112276)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 14:13
VLAI
EPSS
VEX
Title
Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap
Summary
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 14:13 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/netpbm-sunraster-rle-… | third-party-advisory |
| https://sourceforge.net/p/netpbm/code/5400/tree/a… | technical-description |
| https://sourceforge.net/p/netpbm/code/5400/tree/a… | technical-description |
| https://netpbm.sourceforge.net/ | product |
| https://www.vulncheck.com/advisories/netpbm-throu… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-112275-11227… | exploit |
Impacted products
Date Public
2026-10-17 18:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112276",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T14:13:20.015700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:13:40.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-112275-112276-netpbm-sunraster-rle-oob-write-palette-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sourceforge.net/p/netpbm/code/",
"defaultStatus": "unaffected",
"product": "Netpbm",
"repo": "https://sourceforge.net/p/netpbm/code/",
"vendor": "Netpbm",
"versions": [
{
"lessThanOrEqual": "11.16.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndIncluding": "11.16.00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T18:49:38.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:22.723Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/netpbm-sunraster-rle-oob-write-palette-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rasttopnm.c"
},
{
"tags": [
"technical-description"
],
"url": "https://sourceforge.net/p/netpbm/code/5400/tree/advanced/converter/other/rast.c"
},
{
"tags": [
"product"
],
"url": "https://netpbm.sourceforge.net/"
},
{
"name": "VulnCheck Advisory: Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netpbm-through-11.16.00-heap-out-of-bounds-read-via-rasttopnm-colormap"
}
],
"title": "Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112276",
"datePublished": "2026-10-19T13:55:22.723Z",
"dateReserved": "2026-10-19T13:25:29.280Z",
"dateUpdated": "2026-10-19T14:13:40.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112274 (GCVE-0-2026-112274)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 17:57
VLAI
EPSS
VEX
Title
libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init
Summary
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:56 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/libtins-dns-name-pars… | third-party-advisory |
| https://github.com/mfontanini/libtins/blob/v4.6/s… | technical-description |
| https://github.com/mfontanini/libtins | product |
| https://www.vulncheck.com/advisories/libtins-thro… | third-party-advisory |
Date Public
2026-10-17 18:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112274",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:56:57.348204Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:57:12.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/libtins-dns-name-parsing-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/mfontanini/libtins",
"defaultStatus": "unaffected",
"product": "libtins",
"repo": "https://github.com/mfontanini/libtins",
"vendor": "libtins",
"versions": [
{
"lessThanOrEqual": "4.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T18:49:34.000Z",
"descriptions": [
{
"lang": "en",
"value": "libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:21.345Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libtins-dns-name-parsing-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mfontanini/libtins/blob/v4.6/src/dns.cpp#L698-L710"
},
{
"tags": [
"product"
],
"url": "https://github.com/mfontanini/libtins"
},
{
"name": "VulnCheck Advisory: libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libtins-through-4.6-out-of-bounds-read-via-dns-soa-record-init"
}
],
"title": "libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112274",
"datePublished": "2026-10-19T13:55:21.345Z",
"dateReserved": "2026-10-19T13:25:28.669Z",
"dateUpdated": "2026-10-19T17:57:12.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112273 (GCVE-0-2026-112273)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-22 02:51
VLAI
EPSS
VEX
Title
libtins through 4.6 Heap Out-of-Bounds Read via DNS::compose_name
Summary
libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority records trigger a one-byte read when parsed, crashing applications on hardened allocators.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 02:49 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/libtins-dns-name-pars… | third-party-advisory |
| https://github.com/mfontanini/libtins/blob/v4.6/s… | technical-description |
| https://github.com/mfontanini/libtins | product |
| https://www.vulncheck.com/advisories/libtins-thro… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-112273-11227… | exploit |
Date Public
2026-10-17 18:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112273",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T02:49:37.004511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T02:51:25.912Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-112273-112274-libtins-dns-name-parsing-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/mfontanini/libtins",
"defaultStatus": "unaffected",
"product": "libtins",
"repo": "https://github.com/mfontanini/libtins",
"vendor": "libtins",
"versions": [
{
"lessThanOrEqual": "4.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T18:49:34.000Z",
"descriptions": [
{
"lang": "en",
"value": "libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority records trigger a one-byte read when parsed, crashing applications on hardened allocators."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:20.684Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libtins-dns-name-parsing-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mfontanini/libtins/blob/v4.6/src/dns.cpp#L338-L389"
},
{
"tags": [
"product"
],
"url": "https://github.com/mfontanini/libtins"
},
{
"name": "VulnCheck Advisory: libtins through 4.6 Heap Out-of-Bounds Read via DNS::compose_name",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libtins-through-4.6-heap-out-of-bounds-read-via-dns-compose-name"
}
],
"title": "libtins through 4.6 Heap Out-of-Bounds Read via DNS::compose_name",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112273",
"datePublished": "2026-10-19T13:55:20.684Z",
"dateReserved": "2026-10-19T13:25:28.347Z",
"dateUpdated": "2026-10-22T02:51:25.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112272 (GCVE-0-2026-112272)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 19:34
VLAI
EPSS
VEX
Title
libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser
Summary
Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file to over-advance the parse cursor and crash applications.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 19:34 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/libdisplay-info-displ… | third-party-advisory |
| https://gitlab.freedesktop.org/emersion/libdispla… | technical-description |
| https://gitlab.freedesktop.org/emersion/libdisplay-info | product |
| https://www.vulncheck.com/advisories/libdisplay-i… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| emersion | libdisplay-info |
Affected:
0.4.0
(semver)
|
Date Public
2026-10-17 17:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112272",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T19:34:17.281089Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:34:25.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/libdisplay-info-displayid-datablock-overrun-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://gitlab.freedesktop.org/emersion/libdisplay-info",
"defaultStatus": "unaffected",
"product": "libdisplay-info",
"repo": "https://gitlab.freedesktop.org/emersion/libdisplay-info",
"vendor": "emersion",
"versions": [
{
"status": "affected",
"version": "0.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:42.000Z",
"descriptions": [
{
"lang": "en",
"value": "Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file to over-advance the parse cursor and crash applications."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:20.018Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libdisplay-info-displayid-datablock-overrun-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.freedesktop.org/emersion/libdisplay-info/-/blob/0.4.0/displayid2.c#L84-L143"
},
{
"tags": [
"product"
],
"url": "https://gitlab.freedesktop.org/emersion/libdisplay-info"
},
{
"name": "VulnCheck Advisory: libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libdisplay-info-0.4.0-heap-out-of-bounds-read-via-displayid-v2-parser"
}
],
"title": "libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112272",
"datePublished": "2026-10-19T13:55:20.018Z",
"dateReserved": "2026-10-19T13:25:28.002Z",
"dateUpdated": "2026-10-19T19:34:25.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112271 (GCVE-0-2026-112271)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 14:11
VLAI
EPSS
VEX
Title
libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser
Summary
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 14:11 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/libdisplay-info-displ… | third-party-advisory |
| https://gitlab.freedesktop.org/emersion/libdispla… | technical-description |
| https://gitlab.freedesktop.org/emersion/libdisplay-info | product |
| https://www.vulncheck.com/advisories/libdisplay-i… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-112271-11227… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| emersion | libdisplay-info |
Affected:
0 , ≤ 0.4.0
(semver)
|
Date Public
2026-10-17 17:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112271",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T14:11:07.408759Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:11:35.515Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-112271-112272-libdisplay-info-displayid-datablock-overrun-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://gitlab.freedesktop.org/emersion/libdisplay-info",
"defaultStatus": "unaffected",
"product": "libdisplay-info",
"repo": "https://gitlab.freedesktop.org/emersion/libdisplay-info",
"vendor": "emersion",
"versions": [
{
"lessThanOrEqual": "0.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:42.000Z",
"descriptions": [
{
"lang": "en",
"value": "libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block\u0027s declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:19.362Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libdisplay-info-displayid-datablock-overrun-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.freedesktop.org/emersion/libdisplay-info/-/blob/0.4.0/displayid.c#L603-L689"
},
{
"tags": [
"product"
],
"url": "https://gitlab.freedesktop.org/emersion/libdisplay-info"
},
{
"name": "VulnCheck Advisory: libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libdisplay-info-through-0.4.0-heap-out-of-bounds-read-via-displayid-v1-parser"
}
],
"title": "libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112271",
"datePublished": "2026-10-19T13:55:19.362Z",
"dateReserved": "2026-10-19T13:25:27.630Z",
"dateUpdated": "2026-10-19T14:11:35.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112260 (GCVE-0-2026-112260)
Vulnerability from cvelistv5 – Published: 2026-10-19 19:24 – Updated: 2026-11-04 21:54
VLAI
EPSS
VEX
Title
Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
Summary
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 21:22 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
redhat
CNA
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:93975 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2026-112260 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2555730 | issue-trackingx_refsource_REDHAT |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
2:3.0.4-4.el9_8.15 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9::appstream |
|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/a:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:rhel_els:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/a:redhat:enterprise_linux:8
|
Date Public
2026-10-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112260",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T21:22:09.818772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:22:48.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "affected",
"packageName": "gimp",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "2:3.0.4-4.el9_8.15",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "gimp",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
],
"defaultStatus": "unaffected",
"packageName": "gimp",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "unaffected",
"packageName": "gimp",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "gimp:2.8/gimp",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Alexey Khairov (codem4ster), Konstantin Talgarenko (Marcusov), and Nikolay Kravtsov (Kolya080808) for reporting this issue."
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:54:55.483Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:93975",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:93975"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-112260"
},
{
"name": "RHBZ#2555730",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555730"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-15T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing",
"workarounds": [
{
"lang": "en",
"value": "Avoid opening untrusted XCF files in GIMP. If GIMP is unused, remove the gimp package."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-125: Out-of-bounds Read"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-112260",
"datePublished": "2026-10-19T19:24:49.017Z",
"dateReserved": "2026-10-19T13:14:46.797Z",
"dateUpdated": "2026-11-04T21:54:55.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112202 (GCVE-0-2026-112202)
Vulnerability from cvelistv5 – Published: 2026-10-20 22:37 – Updated: 2026-10-30 13:03
VLAI
EPSS
VEX
Title
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images
Summary
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images.
With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected.
The same code ships bundled in the Imager distribution.
An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 13:03 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
CPANSec
CNA
References
5 references
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-21T02:11:40.235Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/1"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-112202",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T13:03:05.754103Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:03:18.800Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Imager::File::GIF"
],
"packageName": "Imager-File-GIF",
"packageURL": "pkg:cpan/Imager-File-GIF",
"programFiles": [
"imgif.c"
],
"programRoutines": [
{
"name": "i_readgif_low"
}
],
"repo": "https://github.com/tonycoz/imager",
"versions": [
{
"lessThan": "1.006",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Imager::File::GIF"
],
"packageName": "Imager",
"packageURL": "pkg:cpan/Imager",
"programFiles": [
"GIF/imgif.c"
],
"programRoutines": [
{
"name": "i_readgif_low"
}
],
"repo": "https://github.com/tonycoz/imager",
"versions": [
{
"lessThan": "1.040",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "kumar-Prakash07"
}
],
"descriptions": [
{
"lang": "en",
"value": "Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images.\n\nWith `gif_consolidate =\u003e 1`, palette indices from the image are used without checking the colour table\u0027s bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected.\n\nThe same code ships bundled in the Imager distribution.\n\nAn attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T22:37:43.477Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/tonycoz/imager/commit/dec96f12b3d8a7fd94e86264953a5e4919dd6036.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/TONYC/Imager-File-GIF-1.006/changes"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/TONYC/Imager-1.040/changes"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/tonycoz/imager/security/advisories/GHSA-v4hp-5h6w-9897"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Imager-File-GIF 1.006 or later, or to Imager 1.040 or later if the bundled copy is in use."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images",
"workarounds": [
{
"lang": "en",
"value": "Disable the gif_consolidate read option when processing untrusted GIF images."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-112202",
"datePublished": "2026-10-20T22:37:43.477Z",
"dateReserved": "2026-10-19T10:02:31.268Z",
"dateUpdated": "2026-10-30T13:03:18.800Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112073 (GCVE-0-2026-112073)
Vulnerability from cvelistv5 – Published: 2026-10-19 03:15 – Updated: 2026-10-22 02:31
VLAI
EPSS
VEX
Title
Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds
Summary
A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 02:31 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421752 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421752/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112073 | third-party-advisory |
| https://vuldb.com/submit/1009476 | third-party-advisory |
| https://github.com/Tencent/ncnn/issues/7034 | exploitissue-tracking |
| https://github.com/Tencent/ncnn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112073",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T02:31:28.454722Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T02:31:41.124Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:tencent:ncnn:*:*:*:*:*:*:*:*"
],
"modules": [
"MatMul"
],
"product": "ncnn",
"vendor": "Tencent",
"versions": [
{
"status": "affected",
"version": "44b02dabdcf97499281a4692ebd65bad73dcf8b6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "JerryGW (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T03:15:18.986Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421752 | Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421752"
},
{
"name": "VDB-421752 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421752/cti"
},
{
"name": "CVE-2026-112073 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112073"
},
{
"name": "Submit #1009476 | Tencent ncnn master 3b7bdba Out-of-Bounds Read",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009476"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Tencent/ncnn/issues/7034"
},
{
"tags": [
"product"
],
"url": "https://github.com/Tencent/ncnn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T15:46:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112073",
"datePublished": "2026-10-19T03:15:18.986Z",
"dateReserved": "2026-10-18T13:41:43.955Z",
"dateUpdated": "2026-10-22T02:31:41.124Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112061 (GCVE-0-2026-112061)
Vulnerability from cvelistv5 – Published: 2026-10-18 12:19 – Updated: 2026-11-06 19:40
VLAI
EPSS
VEX
Title
librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_Decode
Summary
librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes to crash the client.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:42 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/librtmp-amf3-decode-a… | third-party-advisory |
| https://git.ffmpeg.org/gitweb/rtmpdump.git/blob/1… | technical-description |
| https://rtmpdump.mplayerhq.hu/ | product |
| https://www.vulncheck.com/advisories/librtmp-rtmp… | third-party-advisory |
Date Public
2026-10-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112061",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:42:32.714846Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:37:50.638Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://git.ffmpeg.org/rtmpdump",
"defaultStatus": "unaffected",
"product": "librtmp",
"repo": "https://git.ffmpeg.org/rtmpdump",
"vendor": "RTMPDump",
"versions": [
{
"lessThanOrEqual": "2.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
},
{
"lang": "en",
"type": "finder",
"value": "YEO JOOHO (PIOLINK, Inc.)"
}
],
"datePublic": "2026-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes to crash the client."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:40:02.072Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/librtmp-amf3-decode-and-strict-array-oob"
},
{
"tags": [
"technical-description"
],
"url": "https://git.ffmpeg.org/gitweb/rtmpdump.git/blob/138fdb258d9fc26f1843fd1b891180416c9dc575:/librtmp/amf.c"
},
{
"tags": [
"product"
],
"url": "https://rtmpdump.mplayerhq.hu/"
},
{
"name": "VulnCheck Advisory: librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_Decode",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/librtmp-rtmpdump-through-2.6-heap-out-of-bounds-read-via-amfprop-decode"
}
],
"title": "librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_Decode",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112061",
"datePublished": "2026-10-18T12:19:51.237Z",
"dateReserved": "2026-10-18T12:00:07.543Z",
"dateUpdated": "2026-11-06T19:40:02.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112058 (GCVE-0-2026-112058)
Vulnerability from cvelistv5 – Published: 2026-10-18 12:19 – Updated: 2026-10-19 20:30
VLAI
EPSS
VEX
Title
libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT
Summary
VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:29 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/libdvdnav-navigation-… | third-party-advisory |
| https://code.videolan.org/videolan/libdvdnav/-/bl… | technical-description |
| https://www.vulncheck.com/advisories/libdvdnav-th… | third-party-advisory |
Impacted products
Date Public
2026-10-17 17:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112058",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:29:45.550774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:30:01.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/libdvdnav-navigation-index-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://code.videolan.org/videolan/libdvdnav",
"defaultStatus": "unaffected",
"product": "libdvdnav",
"repo": "https://code.videolan.org/videolan/libdvdnav",
"vendor": "VideoLAN",
"versions": [
{
"lessThanOrEqual": "7.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:44.000Z",
"descriptions": [
{
"lang": "en",
"value": "VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:48.829Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libdvdnav-navigation-index-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://code.videolan.org/videolan/libdvdnav/-/blob/7.0.0/src/vm/getset.c#L51"
},
{
"name": "VulnCheck Advisory: libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libdvdnav-through-7.0.0-out-of-bounds-read-via-set-ptt-jumptt"
}
],
"title": "libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112058",
"datePublished": "2026-10-18T12:19:48.829Z",
"dateReserved": "2026-10-18T11:54:43.513Z",
"dateUpdated": "2026-10-19T20:30:01.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.