Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
4530 vulnerabilities reference this CWE, most recent first.
CVE-2026-107634 (GCVE-0-2026-107634)
Vulnerability from cvelistv5 – Published: 2026-10-08 14:10 – Updated: 2026-10-10 03:07
VLAI
EPSS
VEX
Title
Dislocker through 0.7.3 Heap Out-of-Bounds Read via BitLocker Metadata Dataset Size
Summary
Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or datum sizes that, when opened or mounted, crashes dislocker or discloses adjacent heap memory.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 03:07 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Aorimn/dislocker/commit/9158e9… | patch |
| https://github.com/Aorimn/dislocker/blob/v0.7.3/s… | technical-description |
| https://github.com/Aorimn/dislocker/blob/v0.7.3/s… | technical-description |
| https://github.com/Aorimn/dislocker | product |
| https://www.vulncheck.com/advisories/dislocker-th… | third-party-advisory |
Date Public
2026-08-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107634",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T03:07:08.534873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T03:07:18.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "dislocker",
"vendor": "Aorimn",
"versions": [
{
"lessThanOrEqual": "0.7.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (@TristanInSec), Talence Security"
}
],
"datePublic": "2026-08-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or datum sizes that, when opened or mounted, crashes dislocker or discloses adjacent heap memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:10:33.209Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/Aorimn/dislocker/commit/9158e9e41dd669b360cbc53cc18ccae729b67b48"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Aorimn/dislocker/blob/v0.7.3/src/metadata/metadata.c#L764-L790"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Aorimn/dislocker/blob/v0.7.3/src/metadata/datums.c#L589-L640"
},
{
"tags": [
"product"
],
"url": "https://github.com/Aorimn/dislocker"
},
{
"name": "VulnCheck Advisory: Dislocker through 0.7.3 Heap Out-of-Bounds Read via BitLocker Metadata Dataset Size",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dislocker-through-0.7.3-heap-out-of-bounds-read-via-bitlocker-metadata-dataset-size"
}
],
"title": "Dislocker through 0.7.3 Heap Out-of-Bounds Read via BitLocker Metadata Dataset Size",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107634",
"datePublished": "2026-10-08T14:10:33.209Z",
"dateReserved": "2026-10-08T14:05:51.476Z",
"dateUpdated": "2026-10-10T03:07:18.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107614 (GCVE-0-2026-107614)
Vulnerability from cvelistv5 – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:01
VLAI
EPSS
VEX
Title
Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bounds read
Summary
An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI capture path. The loop bound width - 1 wraps to 0xFFFFFFFF, producing an access roughly 4 GB beyond the 64 KB cursor buffer; a monochrome cursor of height 1 also becomes 0 because getCursorHeight() halves the height in place.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:00 UTC
Assigner
securin
CNA
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1661/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107614",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:00:49.369592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:01:01.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Server (cursor shape processing)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"WinCursorShapeUtils.cpp"
],
"programRoutines": [
{
"name": "WinCursorShapeUtils::trimTransparent()"
},
{
"name": "getCursorHeight()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI capture path. The loop bound width - 1 wraps to 0xFFFFFFFF, producing an access roughly 4 GB beyond the 64 KB cursor buffer; a monochrome cursor of height 1 also becomes 0 because getCursorHeight() halves the height in place."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:58.297Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1661",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1661/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bounds read"
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107614",
"datePublished": "2026-10-08T13:39:58.297Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:01:01.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107611 (GCVE-0-2026-107611)
Vulnerability from cvelistv5 – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:03
VLAI
EPSS
VEX
Title
Out-of-bounds read in TightVNC Viewer ZRLE palette decoding
Summary
An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap memory beyond the palette allocation and crash the viewer by sending ZRLE-encoded tiles whose palette indices exceed the declared palette size. readPaletteRleTile() and readPackedPaletteTile() use the attacker-supplied index to look up colours without validating it against the palette size; out-of-bounds heap data is copied into the framebuffer (garbled display) or the read faults, terminating the viewer.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:02 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
securin
CNA
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1657/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107611",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:02:42.563819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:03:01.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Viewer (ZRLE decoder)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"ZrleDecoder.cpp"
],
"programRoutines": [
{
"name": "readPaletteRleTile()"
},
{
"name": "readPackedPaletteTile()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap memory beyond the palette allocation and crash the viewer by sending ZRLE-encoded tiles whose palette indices exceed the declared palette size. readPaletteRleTile() and readPackedPaletteTile() use the attacker-supplied index to look up colours without validating it against the palette size; out-of-bounds heap data is copied into the framebuffer (garbled display) or the read faults, terminating the viewer."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:48.883Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1657",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1657/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "Out-of-bounds read in TightVNC Viewer ZRLE palette decoding",
"workarounds": [
{
"lang": "en",
"value": "Connect only to trusted VNC servers until the viewer is upgraded."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107611",
"datePublished": "2026-10-08T13:39:48.883Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:03:01.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107472 (GCVE-0-2026-107472)
Vulnerability from cvelistv5 – Published: 2026-10-27 07:32 – Updated: 2026-11-04 14:59
VLAI
EPSS
VEX
Title
Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt
Summary
An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 14:51 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
Qt
CNA
References
2 references
| URL | Tags |
|---|---|
| https://wiki.qt.io/List_of_known_vulnerabilities_… | vendor-advisory |
| https://codereview.qt-project.org/c/qt/qt5compat/… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107472",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T14:51:05.682547Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T14:59:57.371Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
"cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*",
"cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"qt5compat",
"qtbase"
],
"product": "Qt",
"vendor": "qt",
"versions": [
{
"lessThanOrEqual": "6.8.8",
"status": "affected",
"version": "4.0.0",
"versionType": "python"
},
{
"lessThanOrEqual": "6.11.2",
"status": "affected",
"version": "6.9.0",
"versionType": "python"
},
{
"lessThan": "4.0.0",
"status": "unaffected",
"version": "0",
"versionType": "python"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.8.8",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.11.2",
"versionStartIncluding": "6.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0",
"versionStartIncluding": "0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.\u003c/p\u003e"
}
],
"value": "An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "GREEN",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Green",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T07:32:31.991Z",
"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"shortName": "Qt"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-107472:"
},
{
"tags": [
"patch"
],
"url": "https://codereview.qt-project.org/c/qt/qt5compat/+/762021"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"assignerShortName": "Qt",
"cveId": "CVE-2026-107472",
"datePublished": "2026-10-27T07:32:31.991Z",
"dateReserved": "2026-10-08T07:42:12.931Z",
"dateUpdated": "2026-11-04T14:59:57.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107373 (GCVE-0-2026-107373)
Vulnerability from cvelistv5 – Published: 2026-10-10 12:44 – Updated: 2026-10-16 15:39
VLAI
EPSS
VEX
Title
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument
Summary
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.
The typemap uses
$var = std::string( SvPV_nolen($arg), SvCUR($arg) )
However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first.
When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:38 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
CPANSec
CNA
References
4 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-107373",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:38:43.311020Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:39:45.111Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"ExtUtils::Typemaps::STL::String"
],
"packageName": "ExtUtils-Typemaps-Default",
"packageURL": "pkg:cpan/ExtUtils-Typemaps-Default",
"programFiles": [
"lib/ExtUtils/Typemaps/STL/String.pm"
],
"repo": "https://github.com/tsee/extutils-typemap-default",
"versions": [
{
"lessThan": "1.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.\n\nThe typemap uses\n\n $var = std::string( SvPV_nolen($arg), SvCUR($arg) )\n\nHowever, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first.\n\nWhen $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T12:44:08.099Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.06/changes"
},
{
"url": "https://github.com/tsee/extutils-typemap-default/commit/a6b9c298b34ddadc582961403e715d292f82a22d"
},
{
"tags": [
"issue-tracking"
],
"url": "https://rt.cpan.org/Public/Bug/Display.html?id=94110"
},
{
"tags": [
"related"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80490"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to ExtUtils::Typemaps::Default version 1.06 or later.\n\nRebuild any modules that use ExtUtils::Typemaps::Default as part of their build process."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2014-03-22T00:00:00.000Z",
"value": "Issue reported in bugtracker for ExtUtils::Typemaps::Default version 1.05."
},
{
"lang": "en",
"time": "2014-06-10T00:00:00.000Z",
"value": "Fix committed to the repository. Bugtracker issue closed."
},
{
"lang": "en",
"time": "2026-09-30T00:00:00.000Z",
"value": "Issue reported to CPANSec."
},
{
"lang": "en",
"time": "2026-10-08T00:00:00.000Z",
"value": "ExtUtils::Typemaps::Default version 1.06 released with a fix."
}
],
"title": "ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot be upgraded, ensure that arguments passed to modules that use ExtUtils::Typemaps::Default are strngified."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-107373",
"datePublished": "2026-10-10T12:44:08.099Z",
"dateReserved": "2026-10-07T21:01:49.472Z",
"dateUpdated": "2026-10-16T15:39:45.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107302 (GCVE-0-2026-107302)
Vulnerability from cvelistv5 – Published: 2026-10-08 17:14 – Updated: 2026-10-19 19:29
VLAI
EPSS
VEX
Title
msgpack5: Truncated map32 headers throw an unexpected error
Summary
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 17:32 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/mcollina/msgpack5/security/adv… | x_refsource_CONFIRM |
| https://github.com/mcollina/msgpack5/commit/15443… | x_refsource_MISC |
| https://github.com/mcollina/msgpack5/releases/tag… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T17:32:15.263797Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T17:32:23.572Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "msgpack5",
"vendor": "mcollina",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.1.0. \u003c 6.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:29:15.139Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-8f34-f56x-9xph"
},
{
"name": "https://github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mcollina/msgpack5/commit/15443a1f2aa682a6aa37f1705ac628de5b866ad1"
},
{
"name": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
}
],
"source": {
"advisory": "GHSA-8f34-f56x-9xph",
"discovery": "UNKNOWN"
},
"title": "msgpack5: Truncated map32 headers throw an unexpected error"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107302",
"datePublished": "2026-10-08T17:14:19.514Z",
"dateReserved": "2026-10-07T15:53:23.587Z",
"dateUpdated": "2026-10-19T19:29:15.139Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107220 (GCVE-0-2026-107220)
Vulnerability from cvelistv5 – Published: 2026-10-07 18:37 – Updated: 2026-10-10 02:41
VLAI
EPSS
VEX
Title
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 02:39 UTC
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2379 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/99903a3… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107220",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T02:39:12.566271Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T02:41:14.449Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.7.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:37:52.712Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff"
},
{
"name": "https://github.com/qax-os/excelize/pull/2379",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2379"
},
{
"name": "https://github.com/qax-os/excelize/commit/99903a3240e58a47ff28fb8e05a03bd9d496ec24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/99903a3240e58a47ff28fb8e05a03bd9d496ec24"
}
],
"source": {
"advisory": "GHSA-g27h-8qhm-6pff",
"discovery": "UNKNOWN"
},
"title": "Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107220",
"datePublished": "2026-10-07T18:37:52.712Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-10T02:41:14.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107157 (GCVE-0-2026-107157)
Vulnerability from cvelistv5 – Published: 2026-10-26 12:52 – Updated: 2026-11-09 06:01
VLAI
EPSS
VEX
Title
Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework
Summary
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:59 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
Qt
CNA
References
2 references
| URL | Tags |
|---|---|
| https://wiki.qt.io/List_of_known_vulnerabilities_… | vendor-advisory |
| https://codereview.qt-project.org/c/qt/qtbase/+/745719 | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107157",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:59:49.279269Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:35:52.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
"cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"qtbase"
],
"platforms": [
"64 bit"
],
"product": "Qt",
"vendor": "qt",
"versions": [
{
"lessThan": "5.12.0",
"status": "unaffected",
"version": "0",
"versionType": "python"
},
{
"lessThanOrEqual": "6.8.8",
"status": "affected",
"version": "5.12.0",
"versionType": "python"
},
{
"lessThanOrEqual": "6.11.1",
"status": "affected",
"version": "6.9.0",
"versionType": "python"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qt:qt:*:*:64_bit:*:*:*:*:*",
"versionEndExcluding": "5.12.0",
"versionStartIncluding": "0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:qt:qt:*:*:64_bit:*:*:*:*:*",
"versionEndIncluding": "6.8.8",
"versionStartIncluding": "5.12.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qt:qt:*:*:64_bit:*:*:*:*:*",
"versionEndIncluding": "6.11.1",
"versionStartIncluding": "6.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information."
}
],
"value": "Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 2,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/RE:L/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T06:01:00.515Z",
"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"shortName": "Qt"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-107157:"
},
{
"tags": [
"patch"
],
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/745719"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"assignerShortName": "Qt",
"cveId": "CVE-2026-107157",
"datePublished": "2026-10-26T12:52:26.628Z",
"dateReserved": "2026-10-07T10:50:59.680Z",
"dateUpdated": "2026-11-09T06:01:00.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106574 (GCVE-0-2026-106574)
Vulnerability from cvelistv5 – Published: 2026-10-07 15:35 – Updated: 2026-10-07 16:17
VLAI
EPSS
VEX
Title
ImageMagick: Heap Buffer Over-Write in distributed pixel cache server will result in a crash
Summary
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server. This issue is fixed in version 7.1.2-31.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 16:17 UTC
CWE
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/ImageMagick/ImageMagick/securi… | x_refsource_CONFIRM |
| https://github.com/ImageMagick/ImageMagick/commit… | x_refsource_MISC |
| https://github.com/ImageMagick/ImageMagick/releas… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ImageMagick | ImageMagick |
Affected:
< 7.1.2-31
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T16:17:10.905407Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T16:17:22.216Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageMagick",
"vendor": "ImageMagick",
"versions": [
{
"status": "affected",
"version": "\u003c 7.1.2-31"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server. This issue is fixed in version 7.1.2-31."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "CWE-131: Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T15:35:22.337Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4fq9-vrx7-gv92",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4fq9-vrx7-gv92"
},
{
"name": "https://github.com/ImageMagick/ImageMagick/commit/c69f54e1c8660e45f2ff83c354bf924a946d9356",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ImageMagick/ImageMagick/commit/c69f54e1c8660e45f2ff83c354bf924a946d9356"
},
{
"name": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31"
}
],
"source": {
"advisory": "GHSA-4fq9-vrx7-gv92",
"discovery": "UNKNOWN"
},
"title": "ImageMagick: Heap Buffer Over-Write in distributed pixel cache server will result in a crash"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106574",
"datePublished": "2026-10-07T15:35:22.337Z",
"dateReserved": "2026-10-06T20:31:59.017Z",
"dateUpdated": "2026-10-07T16:17:22.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106464 (GCVE-0-2026-106464)
Vulnerability from cvelistv5 – Published: 2026-10-14 17:41 – Updated: 2026-11-04 13:20
VLAI
EPSS
VEX
Title
Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing
Summary
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 20:13 UTC
Assigner
eclipse
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse ThreadX NetX Duo |
Affected:
0 , ≤ 6.5.2.202603
(custom)
Unaffected: 6.5.2.202603a |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106464",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T20:13:31.363666Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T20:13:45.214Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eclipse ThreadX NetX Duo",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "6.5.2.202603",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.5.2.202603a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "fdesbiens"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault.\u003c/p\u003e"
}
],
"value": "In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T13:20:59.238Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-ww3q-3444-q488"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/368"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-106464",
"datePublished": "2026-10-14T17:41:43.585Z",
"dateReserved": "2026-10-06T16:53:12.796Z",
"dateUpdated": "2026-11-04T13:20:59.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.