Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
4528 vulnerabilities reference this CWE, most recent first.
CVE-2026-111149 (GCVE-0-2026-111149)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-26 14:01
VLAI
EPSS
VEX
Title
FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits
Summary
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:01 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/freeimage-pict-unpac… | technical-descriptionexploit |
| https://github.com/danoli3/FreeImage/blob/cc2bfc1… | technical-description |
| https://github.com/danoli3/FreeImage | product |
| https://www.vulncheck.com/advisories/freeimage-th… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111149",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:01:17.781657Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:01:27.637Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/danoli3/FreeImage",
"product": "FreeImage",
"repo": "https://github.com/danoli3/FreeImage",
"vendor": "danoli3",
"versions": [
{
"lessThanOrEqual": "3.19.23",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FreeImage",
"vendor": "FreeImage",
"versions": [
{
"lessThanOrEqual": "3.18.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freeimage_project:freeimage:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.18.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:38.810Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/freeimage-pict-unpack32bits-plane-conversion-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/danoli3/FreeImage/blob/cc2bfc1b67d3a10e2c203c56932b09ffb52a4477/Source/FreeImage/PluginPICT.cpp#L605-L650"
},
{
"tags": [
"product"
],
"url": "https://github.com/danoli3/FreeImage"
},
{
"name": "VulnCheck Advisory: FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freeimage-through-3.19.23-heap-out-of-bounds-read-via-pict-unpack32bits"
}
],
"title": "FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111149",
"datePublished": "2026-10-15T18:57:38.810Z",
"dateReserved": "2026-10-15T17:03:59.577Z",
"dateUpdated": "2026-10-26T14:01:27.637Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111148 (GCVE-0-2026-111148)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-15 19:39
VLAI
EPSS
VEX
Title
libsidplayfp through 3.1.1 Heap Out-of-Bounds Read via SidTuneBase::acceptSidTune
Summary
libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs() reads up to 64 KiB past the heap buffer.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:39 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/libsidplayfp-psid-da… | technical-descriptionexploit |
| https://github.com/libsidplayfp/libsidplayfp/blob… | technical-description |
| https://github.com/libsidplayfp/libsidplayfp/blob… | technical-description |
| https://github.com/libsidplayfp/libsidplayfp | product |
| https://www.vulncheck.com/advisories/libsidplayfp… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| libsidplayfp | libsidplayfp |
Affected:
0 , ≤ 3.1.1
(semver)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111148",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:39:30.316995Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:39:50.356Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"product": "libsidplayfp",
"repo": "https://github.com/libsidplayfp/libsidplayfp",
"vendor": "libsidplayfp",
"versions": [
{
"lessThanOrEqual": "3.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs() reads up to 64 KiB past the heap buffer."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:38.114Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/libsidplayfp-psid-dataoffset-underflow-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/libsidplayfp/libsidplayfp/blob/732fa8ec8131fc75aafc2eaea583ddcdeea2a3cc/src/sidtune/SidTuneBase.cpp#L295-L300"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/libsidplayfp/libsidplayfp/blob/732fa8ec8131fc75aafc2eaea583ddcdeea2a3cc/src/sidtune/SidTuneBase.cpp#L488-L500"
},
{
"tags": [
"product"
],
"url": "https://github.com/libsidplayfp/libsidplayfp"
},
{
"name": "VulnCheck Advisory: libsidplayfp through 3.1.1 Heap Out-of-Bounds Read via SidTuneBase::acceptSidTune",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libsidplayfp-through-3.1.1-heap-out-of-bounds-read-via-sidtunebase-acceptsidtune"
}
],
"title": "libsidplayfp through 3.1.1 Heap Out-of-Bounds Read via SidTuneBase::acceptSidTune",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111148",
"datePublished": "2026-10-15T18:57:38.114Z",
"dateReserved": "2026-10-15T17:03:59.231Z",
"dateUpdated": "2026-10-15T19:39:50.356Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111147 (GCVE-0-2026-111147)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-27 01:30
VLAI
EPSS
VEX
Title
Libyal libesedb through 20260704 Heap Out-of-Bounds Read via libesedb_record_get_multi_value
Summary
Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or expose up to about 32 KiB of adjacent heap memory.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:28 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/libesedb-multi-value… | technical-descriptionexploit |
| https://github.com/libyal/libesedb/blob/cf49b6d42… | technical-description |
| https://github.com/libyal/libesedb | product |
| https://www.vulncheck.com/advisories/libyal-libes… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111147",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:28:07.610825Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:10:26.147Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/libyal/libesedb",
"product": "libesedb",
"repo": "https://github.com/libyal/libesedb",
"vendor": "libyal",
"versions": [
{
"lessThanOrEqual": "20260704",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:libesedb_project:libesedb:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or expose up to about 32 KiB of adjacent heap memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T01:30:47.266Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/libesedb-multi-value-offset-table-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/libyal/libesedb/blob/cf49b6d420d4a44dcd6355bc0d6b36f9f580f350/libesedb/libesedb_record.c#L3776-L3830"
},
{
"tags": [
"product"
],
"url": "https://github.com/libyal/libesedb"
},
{
"name": "VulnCheck Advisory: Libyal libesedb through 20260704 Heap Out-of-Bounds Read via libesedb_record_get_multi_value",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libyal-libesedb-through-20260704-heap-out-of-bounds-read-via-libesedb-record-get-multi-value"
}
],
"title": "Libyal libesedb through 20260704 Heap Out-of-Bounds Read via libesedb_record_get_multi_value",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111147",
"datePublished": "2026-10-15T18:57:37.431Z",
"dateReserved": "2026-10-15T17:03:58.901Z",
"dateUpdated": "2026-10-27T01:30:47.266Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111146 (GCVE-0-2026-111146)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-15 19:45
VLAI
EPSS
VEX
Title
ytnef through 2.1.2 Heap Out-of-Bounds Read via MAPIPrint in lib/ytnef.c
Summary
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:38 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/ytnef-decompressrtf-… | technical-descriptionexploit |
| https://github.com/Yeraze/ytnef/issues/112 | issue-tracking |
| https://github.com/Yeraze/ytnef/blob/d9f089144414… | technical-description |
| https://github.com/Yeraze/ytnef/blob/d9f089144414… | technical-description |
| https://github.com/Yeraze/ytnef | product |
| https://www.vulncheck.com/advisories/ytnef-throug… | third-party-advisory |
Impacted products
Date Public
2026-05-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111146",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:38:03.696767Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:45:21.657Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Yeraze/ytnef",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Yeraze/ytnef",
"product": "ytnef",
"repo": "https://github.com/Yeraze/ytnef",
"vendor": "Yeraze",
"versions": [
{
"lessThanOrEqual": "2.1.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ytnef_project:ytnef:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.1.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DrWhax"
},
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-05-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:36.782Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/ytnef-decompressrtf-oob-read"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Yeraze/ytnef/issues/112"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Yeraze/ytnef/blob/d9f089144414d3b0912c29ab96f8f1c591d00319/lib/ytnef.c#L1449-L1458"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Yeraze/ytnef/blob/d9f089144414d3b0912c29ab96f8f1c591d00319/lib/ytnef.c#L1605-L1614"
},
{
"tags": [
"product"
],
"url": "https://github.com/Yeraze/ytnef"
},
{
"name": "VulnCheck Advisory: ytnef through 2.1.2 Heap Out-of-Bounds Read via MAPIPrint in lib/ytnef.c",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ytnef-through-2.1.2-heap-out-of-bounds-read-via-mapiprint-in-lib-ytnef-c"
}
],
"title": "ytnef through 2.1.2 Heap Out-of-Bounds Read via MAPIPrint in lib/ytnef.c",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111146",
"datePublished": "2026-10-15T18:57:36.782Z",
"dateReserved": "2026-10-15T17:03:58.566Z",
"dateUpdated": "2026-10-15T19:45:21.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111145 (GCVE-0-2026-111145)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-21 01:20
VLAI
EPSS
VEX
Title
ytnef through 2.1.2 Heap Out-of-Bounds Read via DecompressRTF
Summary
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 01:20 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/ytnef-decompressrtf-… | technical-descriptionexploit |
| https://github.com/Yeraze/ytnef/issues/112 | issue-tracking |
| https://github.com/Yeraze/ytnef/blob/d9f089144414… | technical-description |
| https://github.com/Yeraze/ytnef | product |
| https://www.vulncheck.com/advisories/ytnef-throug… | third-party-advisory |
Impacted products
Date Public
2026-05-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111145",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T01:20:14.221753Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T01:20:26.553Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Yeraze/ytnef",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Yeraze/ytnef",
"product": "ytnef",
"repo": "https://github.com/Yeraze/ytnef",
"vendor": "Yeraze",
"versions": [
{
"lessThanOrEqual": "2.1.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ytnef_project:ytnef:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.1.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "DrWhax"
},
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-05-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:36.084Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/ytnef-decompressrtf-oob-read"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Yeraze/ytnef/issues/112"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Yeraze/ytnef/blob/d9f089144414d3b0912c29ab96f8f1c591d00319/lib/ytnef.c#L1554-L1563"
},
{
"tags": [
"product"
],
"url": "https://github.com/Yeraze/ytnef"
},
{
"name": "VulnCheck Advisory: ytnef through 2.1.2 Heap Out-of-Bounds Read via DecompressRTF",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ytnef-through-2.1.2-heap-out-of-bounds-read-via-decompressrtf"
}
],
"title": "ytnef through 2.1.2 Heap Out-of-Bounds Read via DecompressRTF",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111145",
"datePublished": "2026-10-15T18:57:36.084Z",
"dateReserved": "2026-10-15T17:03:58.228Z",
"dateUpdated": "2026-10-21T01:20:26.553Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111143 (GCVE-0-2026-111143)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-15 19:44
VLAI
EPSS
VEX
Title
Ansilove libansilove through 1.4.2 Out-of-Bounds Read via ansilove_xbin RLE Decoding
Summary
Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing applications that render untrusted XBIN art.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:43 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/libansilove-xbin-rle… | technical-descriptionexploit |
| https://github.com/ansilove/libansilove/blob/f1b0… | technical-description |
| https://github.com/ansilove/libansilove | product |
| https://www.vulncheck.com/advisories/ansilove-lib… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ansilove | libansilove |
Affected:
0 , ≤ 1.4.2
(custom)
cpe:2.3:a:ansilove:libansilove:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111143",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:43:53.266255Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:44:00.388Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/ansilove/libansilove",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ansilove/libansilove",
"product": "libansilove",
"repo": "https://github.com/ansilove/libansilove",
"vendor": "ansilove",
"versions": [
{
"lessThanOrEqual": "1.4.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ansilove:libansilove:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing applications that render untrusted XBIN art."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:34.707Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/libansilove-xbin-rle-oob-read-and-null-font-deref"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ansilove/libansilove/blob/f1b05447aa566aa4eef9b05ebf8c2aaf1e379cd3/src/loaders/xbin.c#L169-L241"
},
{
"tags": [
"product"
],
"url": "https://github.com/ansilove/libansilove"
},
{
"name": "VulnCheck Advisory: Ansilove libansilove through 1.4.2 Out-of-Bounds Read via ansilove_xbin RLE Decoding",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ansilove-libansilove-through-1.4.2-out-of-bounds-read-via-ansilove-xbin-rle-decoding"
}
],
"title": "Ansilove libansilove through 1.4.2 Out-of-Bounds Read via ansilove_xbin RLE Decoding",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111143",
"datePublished": "2026-10-15T18:57:34.707Z",
"dateReserved": "2026-10-15T17:03:57.541Z",
"dateUpdated": "2026-10-15T19:44:00.388Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111142 (GCVE-0-2026-111142)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-16 17:10
VLAI
EPSS
VEX
Title
Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst
Summary
Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:31 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/zziplib-zip-central-… | technical-description |
| https://github.com/gdraheim/zziplib/blob/f58313c1… | technical-description |
| https://github.com/gdraheim/zziplib/blob/f58313c1… | technical-description |
| https://github.com/gdraheim/zziplib | product |
| https://www.vulncheck.com/advisories/zziplib-thro… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111142",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:31:26.683810Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:10:35.100Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/gdraheim/zziplib",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/gdraheim/zziplib",
"product": "zziplib",
"repo": "https://github.com/gdraheim/zziplib",
"vendor": "gdraheim",
"versions": [
{
"lessThanOrEqual": "0.13.80",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gdraheim:zziplib:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.13.80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:33.992Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haind-pwn/zziplib-zip-central-directory-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/gdraheim/zziplib/blob/f58313c1f65f46bf73f3526d1afd4d6bb46cc4ae/zzip/mmapped.c#L420-L497"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/gdraheim/zziplib/blob/f58313c1f65f46bf73f3526d1afd4d6bb46cc4ae/zzip/mmapped.c#L323-L352"
},
{
"tags": [
"product"
],
"url": "https://github.com/gdraheim/zziplib"
},
{
"name": "VulnCheck Advisory: Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zziplib-through-0.13.80-out-of-bounds-read-via-zzip-disk-findfirst"
}
],
"title": "Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111142",
"datePublished": "2026-10-15T18:57:33.992Z",
"dateReserved": "2026-10-15T17:03:57.191Z",
"dateUpdated": "2026-10-16T17:10:35.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111141 (GCVE-0-2026-111141)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-15 19:46
VLAI
EPSS
VEX
Title
zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing
Summary
zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.
Severity
4.7 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:46 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/zziplib-zip-central-… | technical-description |
| https://github.com/gdraheim/zziplib/blob/f58313c1… | technical-description |
| https://github.com/gdraheim/zziplib | product |
| https://www.vulncheck.com/advisories/zziplib-thro… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111141",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:46:39.295226Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:46:48.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/gdraheim/zziplib",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/gdraheim/zziplib",
"product": "zziplib",
"repo": "https://github.com/gdraheim/zziplib",
"vendor": "gdraheim",
"versions": [
{
"lessThanOrEqual": "0.13.80",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gdraheim:zziplib:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.13.80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:33.318Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haind-pwn/zziplib-zip-central-directory-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/gdraheim/zziplib/blob/f58313c1f65f46bf73f3526d1afd4d6bb46cc4ae/zzip/zip.c#L530-L558"
},
{
"tags": [
"product"
],
"url": "https://github.com/gdraheim/zziplib"
},
{
"name": "VulnCheck Advisory: zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zziplib-through-0.13.80-out-of-bounds-read-via-zzip-parse-root-directory-zip64-parsing"
}
],
"title": "zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111141",
"datePublished": "2026-10-15T18:57:33.318Z",
"dateReserved": "2026-10-15T17:03:56.843Z",
"dateUpdated": "2026-10-15T19:46:48.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111140 (GCVE-0-2026-111140)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-21 01:19
VLAI
EPSS
VEX
Title
libregf through 20260526 Heap Out-of-Bounds Read via libregf_value_item_read_value_data
Summary
libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacent heap bytes or crash parsers like regfexport and plaso.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 01:19 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/libregf-value-data-o… | technical-descriptionexploit |
| https://github.com/libyal/libregf/blob/1a4bd85648… | technical-description |
| https://github.com/libyal/libregf | product |
| https://www.vulncheck.com/advisories/libregf-thro… | third-party-advisory |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111140",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T01:19:30.510964Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T01:19:40.902Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/libyal/libregf",
"defaultStatus": "unaffected",
"product": "libregf",
"repo": "https://github.com/libyal/libregf",
"vendor": "libyal",
"versions": [
{
"lessThanOrEqual": "20260526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacent heap bytes or crash parsers like regfexport and plaso."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:32.622Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/libregf-value-data-offset-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/libyal/libregf/blob/1a4bd856484263caa4a5e0d6ba377c3dc69150c7/libregf/libregf_value_item.c#L789-L935"
},
{
"tags": [
"product"
],
"url": "https://github.com/libyal/libregf"
},
{
"name": "VulnCheck Advisory: libregf through 20260526 Heap Out-of-Bounds Read via libregf_value_item_read_value_data",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libregf-through-20260526-heap-out-of-bounds-read-via-libregf-value-item-read-value-data"
}
],
"title": "libregf through 20260526 Heap Out-of-Bounds Read via libregf_value_item_read_value_data",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111140",
"datePublished": "2026-10-15T18:57:32.622Z",
"dateReserved": "2026-10-15T17:03:56.493Z",
"dateUpdated": "2026-10-21T01:19:40.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111139 (GCVE-0-2026-111139)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-26 14:04
VLAI
EPSS
VEX
Title
NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask
Summary
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmp_decode().
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:04 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/libnsbmp-rle-absolut… | technical-descriptionexploit |
| https://github.com/netsurf-browser/libnsbmp/blob/… | technical-description |
| https://download.netsurf-browser.org/libs/release… | product |
| https://github.com/netsurf-browser/libnsbmp | product |
| https://www.vulncheck.com/advisories/netsurf-libn… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111139",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:04:11.655695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:04:23.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/netsurf-browser/libnsbmp",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/netsurf-browser/libnsbmp",
"product": "libnsbmp",
"repo": "https://github.com/netsurf-browser/libnsbmp",
"vendor": "NetSurf",
"versions": [
{
"lessThanOrEqual": "0.1.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netsurf-browser:libnsbmp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.1.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmp_decode()."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:31.959Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/libnsbmp-rle-absolute-pad-and-ico-mask-oob-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/netsurf-browser/libnsbmp/blob/ea063c9f46acb43e90208da14073332b505ef7e7/src/libnsbmp.c#L835-L873"
},
{
"tags": [
"product"
],
"url": "https://download.netsurf-browser.org/libs/releases/libnsbmp-0.1.7-src.tar.gz"
},
{
"tags": [
"product"
],
"url": "https://github.com/netsurf-browser/libnsbmp"
},
{
"name": "VulnCheck Advisory: NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netsurf-libnsbmp-through-0.1.7-out-of-bounds-read-via-bmp-decode-mask"
}
],
"title": "NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111139",
"datePublished": "2026-10-15T18:57:31.959Z",
"dateReserved": "2026-10-15T17:03:56.133Z",
"dateUpdated": "2026-10-26T14:04:23.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.