Common Weakness Enumeration

CWE-125

Allowed

Out-of-bounds Read

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product reads data past the end, or before the beginning, of the intended buffer.

4527 vulnerabilities reference this CWE, most recent first.

CVE-2026-125178 (GCVE-0-2026-125178)

Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 19:11
VLAI
Title
FFmpeg through 9.0.2 Out-of-Bounds Heap Read via TDSC Cursor Dimensions
Summary
FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc_paint_cursor() reads past the cursor buffer, crashing the decoder or leaking heap memory into frames.
Severity
6.9 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
FFmpeg FFmpeg Affected: 0 , ≤ 9.0.2 (semver)
    cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-09-25 00:00
Credits
Claude and Ada Logics Joshua Rogers (AISLE Research) David Korczynski
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/ffmpeg/ffmpeg",
          "product": "FFmpeg",
          "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
          "vendor": "FFmpeg",
          "versions": [
            {
              "lessThanOrEqual": "9.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.0.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Claude and Ada Logics"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Joshua Rogers (AISLE Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "David Korczynski"
        }
      ],
      "datePublic": "2026-09-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc_paint_cursor() reads past the cursor buffer, crashing the decoder or leaking heap memory into frames."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T19:11:04.895Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24682"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/commit/12c589a37d093cc55618f8377b092dc21416806f"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/tdsc.c#L207"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg"
        },
        {
          "name": "VulnCheck Advisory: FFmpeg through 9.0.2 Out-of-Bounds Heap Read via TDSC Cursor Dimensions",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-heap-read-via-tdsc-cursor-dimensions"
        }
      ],
      "title": "FFmpeg through 9.0.2 Out-of-Bounds Heap Read via TDSC Cursor Dimensions",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125178",
    "datePublished": "2026-11-09T19:11:04.895Z",
    "dateReserved": "2026-11-09T18:15:04.842Z",
    "dateUpdated": "2026-11-09T19:11:04.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125172 (GCVE-0-2026-125172)

Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 19:11
VLAI
Title
FFmpeg through 9.0.2 Out-of-Bounds Read via libxevd EVC NAL Length
Summary
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read past the packet buffer, crashing the application or exposing adjacent heap memory.
Severity
6.9 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
FFmpeg FFmpeg Affected: 7.0 , ≤ 9.0.2 (custom)
    cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-24 00:00
Credits
Joshua Rogers (AISLE Research) Michael Niedermayer
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/ffmpeg/ffmpeg",
          "product": "FFmpeg",
          "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
          "vendor": "FFmpeg",
          "versions": [
            {
              "lessThanOrEqual": "9.0.2",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.0.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joshua Rogers (AISLE Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Michael Niedermayer"
        }
      ],
      "datePublic": "2026-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read past the packet buffer, crashing the application or exposing adjacent heap memory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T19:11:00.713Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25416"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/commit/e06b3953d4253f8b56271628ba4083fde96aeadb"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libxevd.c#L355"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg"
        },
        {
          "name": "VulnCheck Advisory: FFmpeg through 9.0.2 Out-of-Bounds Read via libxevd EVC NAL Length",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-libxevd-evc-nal-length"
        }
      ],
      "title": "FFmpeg through 9.0.2 Out-of-Bounds Read via libxevd EVC NAL Length",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125172",
    "datePublished": "2026-11-09T19:11:00.713Z",
    "dateReserved": "2026-11-09T18:15:02.804Z",
    "dateUpdated": "2026-11-09T19:11:00.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125171 (GCVE-0-2026-125171)

Vulnerability from cvelistv5 – Published: 2026-11-09 19:10 – Updated: 2026-11-09 19:10
VLAI
Title
FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c
Summary
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7_decode_init() does not validate lastframelen against MPC_FRAME_SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure.
Severity
6.9 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
FFmpeg FFmpeg Affected: 0 , ≤ 9.0.2 (semver)
    cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-14 00:00
Credits
zhang xingxing Joshua Rogers (AISLE Research) zhang xingxing
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/ffmpeg/ffmpeg",
          "product": "FFmpeg",
          "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
          "vendor": "FFmpeg",
          "versions": [
            {
              "lessThanOrEqual": "9.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.0.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "zhang xingxing"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Joshua Rogers (AISLE Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "zhang xingxing"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7_decode_init() does not validate lastframelen against MPC_FRAME_SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T19:10:59.844Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25074"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/commit/5d59b7c45d7142bddd13ddc8891e72c5c7dc991b"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mpc7.c#L281"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg"
        },
        {
          "name": "VulnCheck Advisory: FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-in-musepack-sv7-decoder-via-mpc7-c"
        }
      ],
      "title": "FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125171",
    "datePublished": "2026-11-09T19:10:59.844Z",
    "dateReserved": "2026-11-09T18:15:02.481Z",
    "dateUpdated": "2026-11-09T19:10:59.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124996 (GCVE-0-2026-124996)

Vulnerability from cvelistv5 – Published: 2026-11-09 21:45 – Updated: 2026-11-09 21:45 X_Open Source
VLAI
Title
Turboderp-org ExLlamaV3 hash-MoE routing routing.cu routing_sel_norm_kernel out-of-bounds
Summary
A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routing_sel_norm_kernel of the file exllamav3/exllamav3_ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2eid causes out-of-bounds read. Remote exploitation of the attack is possible. Upgrading to version 1.6.4 is sufficient to resolve this issue. Patch name: c9a57ae832a3035e264e0a412e1daf4ebb699b98. Upgrading the affected component is recommended.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
6.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
CWE
Assigner
VulDB CNA
References
Impacted products
Vendor Product Version
Turboderp-org ExLlamaV3 Affected: 1.6.0
Affected: 1.6.1
Affected: 1.6.2
Affected: 1.6.3
Unaffected: 1.6.4
    cpe:2.3:a:turboderp-org:exllamav3:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Dem00000 (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:turboderp-org:exllamav3:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "hash-MoE routing"
          ],
          "product": "ExLlamaV3",
          "vendor": "Turboderp-org",
          "versions": [
            {
              "status": "affected",
              "version": "1.6.0"
            },
            {
              "status": "affected",
              "version": "1.6.1"
            },
            {
              "status": "affected",
              "version": "1.6.2"
            },
            {
              "status": "affected",
              "version": "1.6.3"
            },
            {
              "status": "unaffected",
              "version": "1.6.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Dem00000 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routing_sel_norm_kernel of the file exllamav3/exllamav3_ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2eid causes out-of-bounds read. Remote exploitation of the attack is possible. Upgrading to version 1.6.4 is sufficient to resolve this issue. Patch name: c9a57ae832a3035e264e0a412e1daf4ebb699b98. Upgrading the affected component is recommended."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-Bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T21:45:21.758Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-433166 | Turboderp-org ExLlamaV3 hash-MoE routing routing.cu routing_sel_norm_kernel out-of-bounds",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/433166"
        },
        {
          "name": "VDB-433166 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/433166/cti"
        },
        {
          "name": "CVE-2026-124996 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-124996"
        },
        {
          "name": "Submit #1040627 | turboderp-org exllamav3 1.4.8 through 1.6.1  Out-of-bounds Read",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1040627"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/turboderp-org/exllamav3/issues/526"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/turboderp-org/exllamav3/commit/c9a57ae832a3035e264e0a412e1daf4ebb699b98"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/turboderp-org/exllamav3/releases/tag/v1.6.4"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/turboderp-org/exllamav3/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-09T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-09T16:40:57.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Turboderp-org ExLlamaV3 hash-MoE routing routing.cu routing_sel_norm_kernel out-of-bounds",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-124996",
    "datePublished": "2026-11-09T21:45:21.758Z",
    "dateReserved": "2026-11-09T15:34:53.989Z",
    "dateUpdated": "2026-11-09T21:45:21.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124994 (GCVE-0-2026-124994)

Vulnerability from cvelistv5 – Published: 2026-11-09 20:45 – Updated: 2026-11-09 20:45 X_Open Source
VLAI
Title
Turboderp-org ExLlamaV3 NGramEmbedding ngram.cu ngram_dequant out-of-bounds
Summary
A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file exllamav3/exllamav3_ext/ngram.cu of the component NGramEmbedding. The manipulation of the argument head_bias results in out-of-bounds read. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.4 is sufficient to fix this issue. The patch is identified as c9a57ae832a3035e264e0a412e1daf4ebb699b98. It is suggested to upgrade the affected component.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
6.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CWE
Assigner
VulDB CNA
References
Impacted products
Vendor Product Version
Turboderp-org ExLlamaV3 Affected: 1.6.0
Affected: 1.6.1
Affected: 1.6.2
Affected: 1.6.3
Unaffected: 1.6.4
    cpe:2.3:a:turboderp-org:exllamav3:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Dem00000 (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:turboderp-org:exllamav3:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "NGramEmbedding"
          ],
          "product": "ExLlamaV3",
          "vendor": "Turboderp-org",
          "versions": [
            {
              "status": "affected",
              "version": "1.6.0"
            },
            {
              "status": "affected",
              "version": "1.6.1"
            },
            {
              "status": "affected",
              "version": "1.6.2"
            },
            {
              "status": "affected",
              "version": "1.6.3"
            },
            {
              "status": "unaffected",
              "version": "1.6.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Dem00000 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file exllamav3/exllamav3_ext/ngram.cu of the component NGramEmbedding. The manipulation of the argument head_bias results in out-of-bounds read. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.4 is sufficient to fix this issue. The patch is identified as c9a57ae832a3035e264e0a412e1daf4ebb699b98. It is suggested to upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-Bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T20:45:17.933Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-433165 | Turboderp-org ExLlamaV3 NGramEmbedding ngram.cu ngram_dequant out-of-bounds",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/433165"
        },
        {
          "name": "VDB-433165 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/433165/cti"
        },
        {
          "name": "CVE-2026-124994 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-124994"
        },
        {
          "name": "Submit #1040626 | turboderp-org exllamav3 commit 6ff3a17ea7f3 (version 1.4.8) Out-of-bounds Read",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1040626"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/turboderp-org/exllamav3/issues/525"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/user-attachments/files/33598849/poc.zip"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/turboderp-org/exllamav3/commit/c9a57ae832a3035e264e0a412e1daf4ebb699b98"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/turboderp-org/exllamav3/releases/tag/v1.6.4"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/turboderp-org/exllamav3/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-09T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-09T16:39:16.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Turboderp-org ExLlamaV3 NGramEmbedding ngram.cu ngram_dequant out-of-bounds",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-124994",
    "datePublished": "2026-11-09T20:45:17.933Z",
    "dateReserved": "2026-11-09T15:34:10.983Z",
    "dateUpdated": "2026-11-09T20:45:17.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124586 (GCVE-0-2026-124586)

Vulnerability from cvelistv5 – Published: 2026-11-09 09:15 – Updated: 2026-11-09 09:15
VLAI
Title
Tencent RapidJSON diyfp.h GetCachedPowerByIndex out-of-bounds
Summary
A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
7.3 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
CWE
Assigner
VulDB CNA
References
URL Tags
https://vuldb.com/vuln/433010 vdb-entrytechnical-description
https://vuldb.com/vuln/433010/cti signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124586 third-party-advisory
https://vuldb.com/submit/1039172 third-party-advisory
https://github.com/Tencent/rapidjson/issues/2405 exploitissue-tracking
https://github.com/Tencent/rapidjson/ product
Impacted products
Vendor Product Version
Tencent RapidJSON Affected: 1.1.0
    cpe:2.3:a:tencent:rapidjson:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
shuidajiao (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:tencent:rapidjson:*:*:*:*:*:*:*:*"
          ],
          "product": "RapidJSON",
          "vendor": "Tencent",
          "versions": [
            {
              "status": "affected",
              "version": "1.1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "shuidajiao (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-Bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T09:15:15.469Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-433010 | Tencent RapidJSON diyfp.h GetCachedPowerByIndex out-of-bounds",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/433010"
        },
        {
          "name": "VDB-433010 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/433010/cti"
        },
        {
          "name": "CVE-2026-124586 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-124586"
        },
        {
          "name": "Submit #1039172 | tencent RapidJSON 1.1.0 Out-of-Bounds Read",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1039172"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/Tencent/rapidjson/issues/2405"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/Tencent/rapidjson/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-08T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-08T21:29:07.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Tencent RapidJSON diyfp.h GetCachedPowerByIndex out-of-bounds",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-124586",
    "datePublished": "2026-11-09T09:15:15.469Z",
    "dateReserved": "2026-11-08T20:24:01.430Z",
    "dateUpdated": "2026-11-09T09:15:15.469Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124312 (GCVE-0-2026-124312)

Vulnerability from cvelistv5 – Published: 2026-11-07 14:17 – Updated: 2026-11-09 13:49
VLAI
Title
Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo
Summary
Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying a collocated picture of different resolution. Attackers can craft a VVC bitstream enabling TMVP with a smaller collocated reference picture, causing getColInfo to read past the colMotion allocation when error concealment is enabled.
Severity
5.7 (Medium)
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 13:49 UTC
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
fraunhoferhhi vvdec Affected: 0 , ≤ 3.2.1 (semver)
Create a notification for this product.
Date Public
2026-10-13 00:00
Credits
Alexander A. Shvedov (sigdevel)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124312",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T13:49:35.431537Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T13:49:57.625Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/fraunhoferhhi/vvdec/issues/422"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/fraunhoferhhi/vvdec",
          "product": "vvdec",
          "repo": "https://github.com/fraunhoferhhi/vvdec",
          "vendor": "fraunhoferhhi",
          "versions": [
            {
              "lessThanOrEqual": "3.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexander A. Shvedov (sigdevel)"
        }
      ],
      "datePublic": "2026-10-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying a collocated picture of different resolution. Attackers can craft a VVC bitstream enabling TMVP with a smaller collocated reference picture, causing getColInfo to read past the colMotion allocation when error concealment is enabled."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T14:17:53.762Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec/issues/422"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec/commit/0695c06221c27b3680fec9851ac2cf46b2195ea9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec/blob/v3.2.1/source/Lib/CommonLib/Slice.cpp#L1819-L1859"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec/blob/v3.2.1/source/Lib/CommonLib/CodingStructure.cpp#L453-L458"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec"
        },
        {
          "name": "VulnCheck Advisory: Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-through-3.2.1-heap-out-of-bounds-read-via-codingstructure-getcolinfo"
        }
      ],
      "title": "Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124312",
    "datePublished": "2026-11-07T14:17:53.762Z",
    "dateReserved": "2026-11-07T12:24:20.552Z",
    "dateUpdated": "2026-11-09T13:49:57.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124309 (GCVE-0-2026-124309)

Vulnerability from cvelistv5 – Published: 2026-11-07 14:17 – Updated: 2026-11-07 14:17
VLAI
Title
Fraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalableNesting
Summary
Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supply a crafted VVC bitstream with a scalable nesting SEI containing a nested buffering period SEI to crash the decoder or copy adjacent heap memory.
Severity
6.9 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
fraunhoferhhi vvdec Affected: 0 , < 3.2.1 (semver)
Unaffected: 3.2.1 (semver)
Create a notification for this product.
Date Public
2026-09-06 00:00
Credits
Alexander A. Shvedov (sigdevel)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/fraunhoferhhi/vvdec",
          "product": "vvdec",
          "repo": "https://github.com/fraunhoferhhi/vvdec",
          "vendor": "fraunhoferhhi",
          "versions": [
            {
              "lessThan": "3.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.2.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexander A. Shvedov (sigdevel)"
        }
      ],
      "datePublic": "2026-09-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supply a crafted VVC bitstream with a scalable nesting SEI containing a nested buffering period SEI to crash the decoder or copy adjacent heap memory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T14:17:51.711Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec/issues/397"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec/commit/1d657c7a822987d2ff935e9c227c5faf5318ca06"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/DecoderLib/SEIread.cpp#L586-L592"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/Slice.h#L644"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec"
        },
        {
          "name": "VulnCheck Advisory: Fraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalableNesting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-before-3.2.1-heap-out-of-bounds-read-via-seireader-xparseseiscalablenesting"
        }
      ],
      "title": "Fraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalableNesting",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124309",
    "datePublished": "2026-11-07T14:17:51.711Z",
    "dateReserved": "2026-11-07T12:24:19.492Z",
    "dateUpdated": "2026-11-07T14:17:51.711Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123805 (GCVE-0-2026-123805)

Vulnerability from cvelistv5 – Published: 2026-11-09 19:57 – Updated: 2026-11-09 19:57
VLAI
Title
SIPSorcery: Unbounded SCTP SACK gap/duplicate counts cause out-of-bounds read that kills the data-channel receive thread (DoS)
Summary
SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated WebRTC peer can send a checksum-valid malformed SACK chunk that drives the parser beyond the 262144-byte receive buffer. The resulting IndexOutOfRangeException bypasses the recoverable ApplicationException handler in RTCSctpTransport.DoReceive, causing the generic handler to exit the dedicated receive loop and permanently terminate the SCTP association and all data channels. This issue is fixed in 10.0.14.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-125 - Out-of-bounds Read
  • CWE-755 - Improper Handling of Exceptional Conditions
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
sipsorcery-org sipsorcery Affected: < 10.0.14
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "sipsorcery",
          "vendor": "sipsorcery-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.0.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated WebRTC peer can send a checksum-valid malformed SACK chunk that drives the parser beyond the 262144-byte receive buffer. The resulting IndexOutOfRangeException bypasses the recoverable ApplicationException handler in RTCSctpTransport.DoReceive, causing the generic handler to exit the dedicated receive loop and permanently terminate the SCTP association and all data channels. This issue is fixed in 10.0.14."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755: Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T19:57:35.105Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sipsorcery-org/sipsorcery/security/advisories/GHSA-jwjp-4649-v8jp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sipsorcery-org/sipsorcery/security/advisories/GHSA-jwjp-4649-v8jp"
        },
        {
          "name": "https://github.com/sipsorcery-org/sipsorcery/pull/1772",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sipsorcery-org/sipsorcery/pull/1772"
        },
        {
          "name": "https://github.com/sipsorcery-org/sipsorcery/commit/a2466550bb2a28821c73fb1961bc33dcc467f8cf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sipsorcery-org/sipsorcery/commit/a2466550bb2a28821c73fb1961bc33dcc467f8cf"
        }
      ],
      "source": {
        "advisory": "GHSA-jwjp-4649-v8jp",
        "discovery": "UNKNOWN"
      },
      "title": "SIPSorcery: Unbounded SCTP SACK gap/duplicate counts cause out-of-bounds read that kills the data-channel receive thread (DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123805",
    "datePublished": "2026-11-09T19:57:35.105Z",
    "dateReserved": "2026-11-06T15:27:56.226Z",
    "dateUpdated": "2026-11-09T19:57:35.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123269 (GCVE-0-2026-123269)

Vulnerability from cvelistv5 – Published: 2026-11-06 00:00 – Updated: 2026-11-06 17:44 X_Open Source
VLAI
Title
libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds
Summary
A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.
Severity
4.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
3.3 (Low)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 17:44 UTC
CWE
Assigner
VulDB CNA
References
Impacted products
Vendor Product Version
libyal libvmdk Affected: n/a
    cpe:2.3:a:libyal:libvmdk:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
fczhang (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123269",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T17:44:17.214676Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T17:44:33.655Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:libyal:libvmdk:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Descriptor File Parser"
          ],
          "product": "libvmdk",
          "vendor": "libyal",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "fczhang (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-Bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T00:00:33.592Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-431575 | libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/431575"
        },
        {
          "name": "VDB-431575 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/431575/cti"
        },
        {
          "name": "CVE-2026-123269 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-123269"
        },
        {
          "name": "Submit #1032842 | libyal (Joachim Metz) libvmdk 396e1873a030ac535bf919f6707d5be57613ae08` Memory corruption",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1032842"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/libyal/libvmdk/issues/41"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/user-attachments/files/33394231/03_integer_underflow_poc.zip"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/libyal/libvmdk/commit/175d3fc0a0b961f362f16e7560a6169d7213e16b"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/libyal/libvmdk/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-05T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-05T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-05T19:16:39.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-123269",
    "datePublished": "2026-11-06T00:00:33.592Z",
    "dateReserved": "2026-11-05T18:11:21.135Z",
    "dateUpdated": "2026-11-06T17:44:33.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design

Strategy: Language Selection

Use a language that provides appropriate memory abstractions.

CAPEC-540: Overread Buffers

An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

← Back to the CWE list