Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
4528 vulnerabilities reference this CWE, most recent first.
CVE-2026-112057 (GCVE-0-2026-112057)
Vulnerability from cvelistv5 – Published: 2026-10-18 12:19 – Updated: 2026-10-19 17:58
VLAI
EPSS
VEX
Title
libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
Summary
libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vts_ttn than the title set's entries to crash applications enumerating chapters.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:57 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/libdvdnav-navigation-… | third-party-advisory |
| https://code.videolan.org/videolan/libdvdnav/-/bl… | technical-description |
| https://code.videolan.org/videolan/libdvdnav/-/co… | patch |
| https://www.vulncheck.com/advisories/libdvdnav-be… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-112057-11205… | exploit |
Impacted products
Date Public
2026-10-17 17:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112057",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:57:34.538889Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:58:02.002Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-112057-112058-libdvdnav-navigation-index-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://code.videolan.org/videolan/libdvdnav",
"defaultStatus": "unaffected",
"product": "libdvdnav",
"repo": "https://code.videolan.org/videolan/libdvdnav",
"vendor": "VideoLAN",
"versions": [
{
"lessThan": "7.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:44.000Z",
"descriptions": [
{
"lang": "en",
"value": "libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vts_ttn than the title set\u0027s entries to crash applications enumerating chapters."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:48.021Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libdvdnav-navigation-index-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://code.videolan.org/videolan/libdvdnav/-/blob/6.1.1/src/searching.c#L670"
},
{
"tags": [
"patch"
],
"url": "https://code.videolan.org/videolan/libdvdnav/-/commit/1d2af48d685911a169fe77d500b1d426910c6f77"
},
{
"name": "VulnCheck Advisory: libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libdvdnav-before-7.0.0-out-of-bounds-read-in-dvdnav-describe-title-chapters"
}
],
"title": "libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112057",
"datePublished": "2026-10-18T12:19:48.021Z",
"dateReserved": "2026-10-18T11:54:43.170Z",
"dateUpdated": "2026-10-19T17:58:02.002Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112056 (GCVE-0-2026-112056)
Vulnerability from cvelistv5 – Published: 2026-10-18 12:19 – Updated: 2026-10-19 16:37
VLAI
EPSS
VEX
Title
wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH
Summary
wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past heap arrays, crashing applications such as AbiWord.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:35 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/wv-fkp-crun-stsh-cstd… | third-party-advisory |
| https://github.com/AbiWord/wv/blob/wv-1-2-9/style… | technical-description |
| https://www.vulncheck.com/advisories/wvware-wv-th… | third-party-advisory |
Date Public
2026-10-17 18:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112056",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:35:45.494968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:37:58.644Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/AbiWord/wv",
"defaultStatus": "unaffected",
"product": "wv",
"repo": "https://github.com/AbiWord/wv",
"vendor": "wvWare",
"versions": [
{
"lessThanOrEqual": "1.2.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T18:49:40.000Z",
"descriptions": [
{
"lang": "en",
"value": "wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past heap arrays, crashing applications such as AbiWord."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:47.212Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/wv-fkp-crun-stsh-cstd-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AbiWord/wv/blob/wv-1-2-9/stylesheet.c#L447"
},
{
"name": "VulnCheck Advisory: wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wvware-wv-through-1.2.9-heap-out-of-bounds-read-via-wvgetstsh"
}
],
"title": "wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112056",
"datePublished": "2026-10-18T12:19:47.212Z",
"dateReserved": "2026-10-18T11:54:42.805Z",
"dateUpdated": "2026-10-19T16:37:58.644Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112055 (GCVE-0-2026-112055)
Vulnerability from cvelistv5 – Published: 2026-10-18 12:19 – Updated: 2026-10-19 16:29
VLAI
EPSS
VEX
Title
wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP
Summary
wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like AbiWord.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:29 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/wv-fkp-crun-stsh-cstd… | third-party-advisory |
| https://github.com/AbiWord/wv/blob/wv-1-2-9/fkp.c#L122 | technical-description |
| https://www.vulncheck.com/advisories/wvware-wv-th… | third-party-advisory |
Date Public
2026-10-17 18:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112055",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:29:17.484327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:29:54.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/wv-fkp-crun-stsh-cstd-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/AbiWord/wv",
"defaultStatus": "unaffected",
"product": "wv",
"repo": "https://github.com/AbiWord/wv",
"vendor": "wvWare",
"versions": [
{
"lessThanOrEqual": "1.2.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T18:49:40.000Z",
"descriptions": [
{
"lang": "en",
"value": "wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like AbiWord."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:46.319Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/wv-fkp-crun-stsh-cstd-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AbiWord/wv/blob/wv-1-2-9/fkp.c#L122"
},
{
"name": "VulnCheck Advisory: wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wvware-wv-through-1.2.9-stack-out-of-bounds-read-via-wvgetpapx-fkp-and-wvgetchpx-fkp"
}
],
"title": "wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112055",
"datePublished": "2026-10-18T12:19:46.319Z",
"dateReserved": "2026-10-18T11:54:42.475Z",
"dateUpdated": "2026-10-19T16:29:54.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112053 (GCVE-0-2026-112053)
Vulnerability from cvelistv5 – Published: 2026-10-18 12:19 – Updated: 2026-10-19 20:28 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix
Summary
Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filter index of 7 or more or transform depth of 5 or 6 to crash decoding applications.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:28 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/schroedinger-lowdelay… | third-party-advisory |
| https://github.com/Distrotech/schroedinger/blob/s… | technical-description |
| https://www.vulncheck.com/advisories/schroedinger… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Schroedinger | schroedinger |
Affected:
0 , ≤ 1.0.11
(custom)
|
Date Public
2026-10-17 17:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112053",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:28:18.554737Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:25.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/schroedinger-lowdelay-quant-matrix-oob"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "schroedinger",
"vendor": "Schroedinger",
"versions": [
{
"lessThanOrEqual": "1.0.11",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:56.000Z",
"descriptions": [
{
"lang": "en",
"value": "Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filter index of 7 or more or transform depth of 5 or 6 to crash decoding applications."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:44.638Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/schroedinger-lowdelay-quant-matrix-oob"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Distrotech/schroedinger/blob/schroedinger-1.0.11/schroedinger/schroparams.c#L463"
},
{
"name": "VulnCheck Advisory: Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/schroedinger-libschroedinger-through-1.0.11-out-of-bounds-read-via-schro-params-set-default-quant-matrix"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112053",
"datePublished": "2026-10-18T12:19:44.638Z",
"dateReserved": "2026-10-18T11:54:41.794Z",
"dateUpdated": "2026-10-19T20:28:25.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112020 (GCVE-0-2026-112020)
Vulnerability from cvelistv5 – Published: 2026-10-18 11:38 – Updated: 2026-10-22 02:15
VLAI
EPSS
VEX
Title
LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()
Summary
LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 02:15 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/lodepng-getfiltertype… | technical-description |
| https://github.com/lvandeve/lodepng/blob/e584a849… | technical-description |
| https://github.com/lvandeve/lodepng | product |
| https://www.vulncheck.com/advisories/lodepng-thro… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-112020-lodep… | exploit |
Impacted products
Date Public
2026-10-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112020",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T02:15:13.942977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T02:15:36.959Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-112020-lodepng-getfiltertypesinterlaced-short-idat-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/lvandeve/lodepng",
"product": "lodepng",
"repo": "https://github.com/lvandeve/lodepng",
"vendor": "lvandeve",
"versions": [
{
"lessThanOrEqual": "20261006",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lodev:lodepng:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2026-10-06",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:38:39.921Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haindpwn/lodepng-getfiltertypesinterlaced-short-idat-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/lvandeve/lodepng/blob/e584a8490db1b76b81bf298c11c09d3b55d9c270/lodepng_util.cpp#L185-L203"
},
{
"tags": [
"product"
],
"url": "https://github.com/lvandeve/lodepng"
},
{
"name": "VulnCheck Advisory: LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lodepng-through-20261006-heap-out-of-bounds-read-via-getfiltertypesinterlaced"
}
],
"title": "LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112020",
"datePublished": "2026-10-18T11:38:39.921Z",
"dateReserved": "2026-10-18T01:24:55.951Z",
"dateUpdated": "2026-10-22T02:15:36.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112019 (GCVE-0-2026-112019)
Vulnerability from cvelistv5 – Published: 2026-10-18 11:38 – Updated: 2026-10-20 17:42
VLAI
EPSS
VEX
Title
cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()
Summary
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to read adjacent heap memory into vertex data or crash applications.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 17:42 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/cgltf-accessor-unpack… | technical-description |
| https://github.com/jkuhlmann/cgltf/blob/360db1a95… | technical-description |
| https://github.com/jkuhlmann/cgltf/blob/360db1a95… | technical-description |
| https://github.com/jkuhlmann/cgltf | product |
| https://www.vulncheck.com/advisories/cgltf-throug… | third-party-advisory |
Date Public
2026-10-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112019",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T17:42:17.788312Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T17:42:50.088Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cgltf-accessor-unpack-floats-sparse-oob"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/jkuhlmann/cgltf",
"product": "cgltf",
"repo": "https://github.com/jkuhlmann/cgltf",
"vendor": "jkuhlmann",
"versions": [
{
"lessThanOrEqual": "1.15",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to read adjacent heap memory into vertex data or crash applications."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:38:39.224Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haindpwn/cgltf-accessor-unpack-floats-sparse-oob"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jkuhlmann/cgltf/blob/360db1a95480fe102ae9c69b27c5d101167ff5ba/cgltf.h#L2436-L2441"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jkuhlmann/cgltf/blob/360db1a95480fe102ae9c69b27c5d101167ff5ba/cgltf.h#L1612-L1619"
},
{
"tags": [
"product"
],
"url": "https://github.com/jkuhlmann/cgltf"
},
{
"name": "VulnCheck Advisory: cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cgltf-through-1.15-heap-out-of-bounds-read-via-cgltf-accessor-unpack-floats"
}
],
"title": "cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112019",
"datePublished": "2026-10-18T11:38:39.224Z",
"dateReserved": "2026-10-18T01:24:55.584Z",
"dateUpdated": "2026-10-20T17:42:50.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112009 (GCVE-0-2026-112009)
Vulnerability from cvelistv5 – Published: 2026-10-18 11:38 – Updated: 2026-10-18 12:23
VLAI
EPSS
VEX
Title
smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer
Summary
smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashes applications opening it through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 12:17 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/smpeg-system-header-s… | technical-descriptionexploit |
| https://github.com/icculus/smpeg/blob/d188dc111f4… | technical-description |
| https://github.com/icculus/smpeg | product |
| https://www.vulncheck.com/advisories/smpeg-throug… | third-party-advisory |
Date Public
2026-10-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112009",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T12:17:03.445754Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:23:31.861Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/icculus/smpeg",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/icculus/smpeg",
"product": "smpeg",
"repo": "https://github.com/icculus/smpeg",
"vendor": "icculus",
"versions": [
{
"lessThanOrEqual": "2.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashes applications opening it through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:38:31.991Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haindpwn/smpeg-system-header-stream-table-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/icculus/smpeg/blob/d188dc111f4817288718705e4a84e248803ccfdc/MPEGsystem.cpp#L803-L823"
},
{
"tags": [
"product"
],
"url": "https://github.com/icculus/smpeg"
},
{
"name": "VulnCheck Advisory: smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/smpeg-through-2.0.0-heap-out-of-bounds-read-via-mpegsystem-fillbuffer"
}
],
"title": "smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112009",
"datePublished": "2026-10-18T11:38:31.991Z",
"dateReserved": "2026-10-18T01:23:46.084Z",
"dateUpdated": "2026-10-18T12:23:31.861Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111959 (GCVE-0-2026-111959)
Vulnerability from cvelistv5 – Published: 2026-11-02 13:34 – Updated: 2026-11-06 18:35
VLAI
EPSS
VEX
Title
Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
Summary
Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.
Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.
Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 18:35 UTC
Assigner
apache
CNA
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Arrow Rust |
Affected:
60.0.0 , < 60.1.0
(semver)
Affected: 59.0.0 , ≤ 59.3.1 (semver) Affected: 58.0.0 , ≤ 58.4.0 (semver) Affected: 33.0.0 , ≤ 57.3.1 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-11-02T20:05:09.522Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/11/02/2"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-111959",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T18:35:18.470735Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T18:35:40.676Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io",
"defaultStatus": "unaffected",
"packageName": "arrow",
"packageURL": "pkg:cargo/arrow",
"product": "Apache Arrow Rust",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "60.1.0",
"status": "affected",
"version": "60.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "59.3.1",
"status": "affected",
"version": "59.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "58.4.0",
"status": "affected",
"version": "58.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "57.3.1",
"status": "affected",
"version": "33.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Adam Korczynski of Ada Logics"
},
{
"lang": "en",
"type": "finder",
"value": "Anthropic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOut-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.\u003c/p\u003e\u003cp\u003eImproper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.\u003c/p\u003e"
}
],
"value": "Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.\n\n\n\nImproper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.\n\n\n\nUsers are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T13:34:17.835Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/hnlrdk4w99b188w1zgjlctpwpg7y55o4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111959",
"datePublished": "2026-11-02T13:34:17.835Z",
"dateReserved": "2026-10-17T16:33:55.330Z",
"dateUpdated": "2026-11-06T18:35:40.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111735 (GCVE-0-2026-111735)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:42 – Updated: 2026-11-05 21:23
VLAI
EPSS
VEX
Title
Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
Summary
P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer. This can cause a crash (denial of service) or disclose memory content.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:23 UTC
Assigner
rt-labs
CNA
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111735",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:23:06.376150Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:23:14.959Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "P-Net",
"vendor": "RT-Labs",
"versions": [
{
"lessThan": "1.0.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eP-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer. This can cause a crash (denial of service) or disclose memory content.\u003c/p\u003e"
}
],
"value": "P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer. This can cause a crash (denial of service) or disclose memory content."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:42:29.115Z",
"orgId": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee",
"shortName": "rt-labs"
},
"references": [
{
"name": "Cybersecurity advisory for P-Net",
"url": "https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to P-Net 1.0.3 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to P-Net 1.0.3 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()"
}
},
"cveMetadata": {
"assignerOrgId": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee",
"assignerShortName": "rt-labs",
"cveId": "CVE-2026-111735",
"datePublished": "2026-10-29T15:42:29.115Z",
"dateReserved": "2026-10-16T15:50:17.803Z",
"dateUpdated": "2026-11-05T21:23:14.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111734 (GCVE-0-2026-111734)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:42 – Updated: 2026-11-05 21:22
VLAI
EPSS
VEX
Title
Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()
Summary
P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end of the receive buffer. This can cause a crash (denial of service) or disclose memory content.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:22 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
rt-labs
CNA
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111734",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:22:32.450736Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:22:43.531Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "P-Net",
"vendor": "RT-Labs",
"versions": [
{
"lessThan": "1.0.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "router0mail"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eP-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end of the receive buffer. This can cause a crash (denial of service) or disclose memory content.\u003c/p\u003e"
}
],
"value": "P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end of the receive buffer. This can cause a crash (denial of service) or disclose memory content."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:42:10.509Z",
"orgId": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee",
"shortName": "rt-labs"
},
"references": [
{
"name": "Cybersecurity advisory for P-Net",
"url": "https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to P-Net 1.0.3 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to P-Net 1.0.3 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()"
}
},
"cveMetadata": {
"assignerOrgId": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee",
"assignerShortName": "rt-labs",
"cveId": "CVE-2026-111734",
"datePublished": "2026-10-29T15:42:10.509Z",
"dateReserved": "2026-10-16T15:50:07.055Z",
"dateUpdated": "2026-11-05T21:22:43.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.