Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
4527 vulnerabilities reference this CWE, most recent first.
CVE-2026-118444 (GCVE-0-2026-118444)
Vulnerability from cvelistv5 – Published: 2026-11-03 09:00 – Updated: 2026-11-03 18:32 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Out-of-bounds reads during instruction decoding in pybddisasm
Summary
Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:24 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
Bitdefender
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://pypi.org/project/pybddisasm/ |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bitdefender | pybddisasm |
Affected:
0 , ≤ 0.3.0
(python)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118444",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:24:13.482628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:32:44.913Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org",
"defaultStatus": "unknown",
"packageName": "pybddisasm",
"product": "pybddisasm",
"vendor": "Bitdefender",
"versions": [
{
"lessThanOrEqual": "0.3.0",
"status": "affected",
"version": "0",
"versionType": "python"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "sl4x0"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOut-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.\u003c/p\u003e"
}
],
"value": "Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T09:00:36.256Z",
"orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"shortName": "Bitdefender"
},
"references": [
{
"url": "https://pypi.org/project/pybddisasm/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDiscontinue use of the unmaintained pybddisasm package. No fixed release will become available..\u003c/p\u003e"
}
],
"value": "Discontinue use of the unmaintained pybddisasm package. No fixed release will become available.."
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Out-of-bounds reads during instruction decoding in pybddisasm",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"assignerShortName": "Bitdefender",
"cveId": "CVE-2026-118444",
"datePublished": "2026-11-03T09:00:36.256Z",
"dateReserved": "2026-10-28T08:25:09.715Z",
"dateUpdated": "2026-11-03T18:32:44.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118237 (GCVE-0-2026-118237)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:51 – Updated: 2026-11-06 19:09
VLAI
EPSS
VEX
Title
Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service
Summary
An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:09 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
GitHub_P
CNA
References
4 references
| URL | Tags |
|---|---|
| https://docs.github.com/en/enterprise-server@3.19… | release-notes |
| https://docs.github.com/en/enterprise-server@3.20… | release-notes |
| https://docs.github.com/en/enterprise-server@3.21… | release-notes |
| https://docs.github.com/en/enterprise-server@3.22… | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GitHub | Enterprise Server |
Affected:
3.19.0 , < 3.19.*
(semver)
Affected: 3.20.0 , < 3.20.* (semver) Affected: 3.21.0 , < 3.21.* (semver) Affected: 3.22.0 , < 3.22.* (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118237",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:09:19.422642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:09:30.593Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Enterprise Server",
"vendor": "GitHub",
"versions": [
{
"changes": [
{
"at": "3.19.14",
"status": "unaffected"
}
],
"lessThan": "3.19.*",
"status": "affected",
"version": "3.19.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "3.20.10",
"status": "unaffected"
}
],
"lessThan": "3.20.*",
"status": "affected",
"version": "3.20.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "3.21.8",
"status": "unaffected"
}
],
"lessThan": "3.21.*",
"status": "affected",
"version": "3.21.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "3.22.3",
"status": "unaffected"
}
],
"lessThan": "3.22.*",
"status": "affected",
"version": "3.22.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "R31n"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld\u0027s SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld\u0027s SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:51:42.155Z",
"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
"shortName": "GitHub_P"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14"
},
{
"tags": [
"release-notes"
],
"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10"
},
{
"tags": [
"release-notes"
],
"url": "https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8"
},
{
"tags": [
"release-notes"
],
"url": "https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
"assignerShortName": "GitHub_P",
"cveId": "CVE-2026-118237",
"datePublished": "2026-11-03T22:51:42.155Z",
"dateReserved": "2026-10-27T19:28:49.006Z",
"dateUpdated": "2026-11-06T19:09:30.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117557 (GCVE-0-2026-117557)
Vulnerability from cvelistv5 – Published: 2026-10-27 13:07 – Updated: 2026-11-04 16:52
VLAI
EPSS
VEX
Title
SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader
Summary
SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 16:52 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/libsdl-org/SDL_image/issues/769 | issue-tracking |
| https://github.com/libsdl-org/SDL_image | product |
| https://github.com/libsdl-org/SDL_image/commit/5c… | patch |
| https://github.com/libsdl-org/SDL_image/commit/9c… | patch |
| https://github.com/libsdl-org/SDL_image/blob/rele… | technical-description |
| https://www.vulncheck.com/advisories/sdl-image-th… | third-party-advisory |
| https://hackmd.io/@haindpwn/sdl-image-lbm-ham-oob-read | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| libsdl-org | SDL_image |
Affected:
0 , ≤ 2.8.12
(semver)
Affected: 3.0.0 , ≤ 3.4.8 (semver) cpe:2.3:a:libsdl:sdl_image:*:*:*:*:*:*:*:* cpe:2.3:a:libsdl:sdl_image:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-117557",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T16:52:25.426552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T16:52:35.775Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/sdl-image-lbm-ham-oob-read"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SDL_image",
"vendor": "libsdl-org",
"versions": [
{
"lessThanOrEqual": "2.8.12",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "3.4.8",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:libsdl:sdl_image:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.8.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:libsdl:sdl_image:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.4.8",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T13:07:52.419Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #769",
"tags": [
"issue-tracking"
],
"url": "https://github.com/libsdl-org/SDL_image/issues/769"
},
{
"tags": [
"product"
],
"url": "https://github.com/libsdl-org/SDL_image"
},
{
"tags": [
"patch"
],
"url": "https://github.com/libsdl-org/SDL_image/commit/5cfbe85f3a783417eec4d5aa0660b40c2cff5292"
},
{
"tags": [
"patch"
],
"url": "https://github.com/libsdl-org/SDL_image/commit/9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/libsdl-org/SDL_image/blob/release-3.4.8/src/IMG_lbm.c#L240"
},
{
"name": "VulnCheck Advisory: SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sdl-image-through-3.4.8-and-2.8.12-stack-out-of-bounds-read-in-ilbm-loader"
}
],
"title": "SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-117557",
"datePublished": "2026-10-27T13:07:52.419Z",
"dateReserved": "2026-10-27T11:25:21.355Z",
"dateUpdated": "2026-11-04T16:52:35.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117556 (GCVE-0-2026-117556)
Vulnerability from cvelistv5 – Published: 2026-10-27 13:07 – Updated: 2026-10-28 16:17
VLAI
EPSS
VEX
Title
zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()
Summary
zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 15:54 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/zchunk/zchunk/issues/119 | issue-tracking |
| https://github.com/zchunk/zchunk | product |
| https://github.com/zchunk/zchunk/commit/02b371a64… | patch |
| https://github.com/zchunk/zchunk/releases/tag/1.5.5 | release-notes |
| https://github.com/zchunk/zchunk/blob/1.5.4/src/l… | technical-description |
| https://www.vulncheck.com/advisories/zchunk-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-117556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T15:54:22.919848Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:17:15.487Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zchunk",
"vendor": "zchunk",
"versions": [
{
"lessThan": "1.5.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zchunk:zchunk:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T13:07:51.708Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #119",
"tags": [
"issue-tracking"
],
"url": "https://github.com/zchunk/zchunk/issues/119"
},
{
"tags": [
"product"
],
"url": "https://github.com/zchunk/zchunk"
},
{
"tags": [
"patch"
],
"url": "https://github.com/zchunk/zchunk/commit/02b371a64bf98245df97315d07c684a0ca5ea1df"
},
{
"name": "zchunk 1.5.5 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/zchunk/zchunk/releases/tag/1.5.5"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zchunk/zchunk/blob/1.5.4/src/lib/header.c#L167"
},
{
"name": "VulnCheck Advisory: zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zchunk-before-1.5.5-heap-out-of-bounds-read-via-read-preface"
}
],
"title": "zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-117556",
"datePublished": "2026-10-27T13:07:51.708Z",
"dateReserved": "2026-10-27T11:25:20.941Z",
"dateUpdated": "2026-10-28T16:17:15.487Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116841 (GCVE-0-2026-116841)
Vulnerability from cvelistv5 – Published: 2026-10-27 00:34 – Updated: 2026-11-05 17:24
VLAI
EPSS
VEX
Title
DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup
Summary
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 17:23 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/diasurgical/DevilutionX/issues/8758 | issue-tracking |
| https://github.com/diasurgical/DevilutionX/pull/8482 | patchissue-tracking |
| https://github.com/diasurgical/libmpq/blob/b78d66… | technical-description |
| https://github.com/diasurgical/DevilutionX/blob/7… | technical-description |
| https://hackmd.io/@haindpwn/devilutionx-libmpq-ha… | technical-description |
| https://www.vulncheck.com/advisories/devilutionx-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| diasurgical | DevilutionX |
Affected:
1.4.0 , ≤ 1.5.5
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116841",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T17:23:55.442791Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T17:24:04.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oob"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/diasurgical/DevilutionX",
"product": "DevilutionX",
"vendor": "diasurgical",
"versions": [
{
"lessThanOrEqual": "1.5.5",
"status": "affected",
"version": "1.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game\u0027s data path, such as a mod, to trigger reads past mpq_map and crash the game."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T00:34:00.513Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/diasurgical/DevilutionX/issues/8758"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/diasurgical/DevilutionX/pull/8482"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/diasurgical/libmpq/blob/b78d66c6fee6a501cc9b95d8556a129c68841b05/libmpq/mpq.c#L740"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/diasurgical/DevilutionX/blob/7223eeac9e8274fbf665b4de86fda26d3b22c52f/3rdParty/libmpq/CMakeLists.txt"
},
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oob"
},
{
"name": "VulnCheck Advisory: DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/devilutionx-1.4.0-through-1.5.5-out-of-bounds-read-via-libmpq-hash-table-lookup"
}
],
"title": "DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116841",
"datePublished": "2026-10-27T00:34:00.513Z",
"dateReserved": "2026-10-27T00:10:22.403Z",
"dateUpdated": "2026-11-05T17:24:04.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116784 (GCVE-0-2026-116784)
Vulnerability from cvelistv5 – Published: 2026-11-05 19:31 – Updated: 2026-11-05 21:07
VLAI
EPSS
VEX
Title
FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing
Summary
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw, including calls where remote SDP enables video RTCP even though the SIP profile has no explicit RTCP interval configured. The out-of-bounds read can crash FreeSWITCH and terminate every active call, but supplies no write primitive and does not echo the read values to the sender. This issue is fixed in version 1.11.2.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:07 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/signalwire/freeswitch/security… | x_refsource_CONFIRM |
| https://github.com/signalwire/freeswitch/commit/e… | x_refsource_MISC |
| https://github.com/signalwire/freeswitch/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| signalwire | freeswitch |
Affected:
< 1.11.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116784",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:07:10.217350Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:07:21.645Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "freeswitch",
"vendor": "signalwire",
"versions": [
{
"status": "affected",
"version": "\u003c 1.11.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet\u0027s declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw, including calls where remote SDP enables video RTCP even though the SIP profile has no explicit RTCP interval configured. The out-of-bounds read can crash FreeSWITCH and terminate every active call, but supplies no write primitive and does not echo the read values to the sender. This issue is fixed in version 1.11.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T19:31:12.864Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-f3xg-63wg-hjw4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-f3xg-63wg-hjw4"
},
{
"name": "https://github.com/signalwire/freeswitch/commit/e730a4e541b2cb49d54018a15f775728e19ce17f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/signalwire/freeswitch/commit/e730a4e541b2cb49d54018a15f775728e19ce17f"
},
{
"name": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.2"
}
],
"source": {
"advisory": "GHSA-f3xg-63wg-hjw4",
"discovery": "UNKNOWN"
},
"title": "FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-116784",
"datePublished": "2026-11-05T19:31:12.864Z",
"dateReserved": "2026-10-26T21:53:35.167Z",
"dateUpdated": "2026-11-05T21:07:21.645Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116782 (GCVE-0-2026-116782)
Vulnerability from cvelistv5 – Published: 2026-11-05 19:42 – Updated: 2026-11-05 21:05
VLAI
EPSS
VEX
Title
FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling
Summary
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:05 UTC
CWE
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/signalwire/freeswitch/security… | x_refsource_CONFIRM |
| https://github.com/signalwire/freeswitch/commit/1… | x_refsource_MISC |
| https://github.com/signalwire/freeswitch/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| signalwire | freeswitch |
Affected:
< 1.11.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116782",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:05:48.754563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:05:58.726Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "freeswitch",
"vendor": "signalwire",
"versions": [
{
"status": "affected",
"version": "\u003c 1.11.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T19:42:40.331Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-v7mq-h638-6fxp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-v7mq-h638-6fxp"
},
{
"name": "https://github.com/signalwire/freeswitch/commit/150295ecff43b5ffecf43f250eef3c4fba37b6d5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/signalwire/freeswitch/commit/150295ecff43b5ffecf43f250eef3c4fba37b6d5"
},
{
"name": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.2"
}
],
"source": {
"advisory": "GHSA-v7mq-h638-6fxp",
"discovery": "UNKNOWN"
},
"title": "FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-116782",
"datePublished": "2026-11-05T19:42:40.331Z",
"dateReserved": "2026-10-26T21:53:35.166Z",
"dateUpdated": "2026-11-05T21:05:58.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116780 (GCVE-0-2026-116780)
Vulnerability from cvelistv5 – Published: 2026-11-05 19:34 – Updated: 2026-11-09 18:07
VLAI
EPSS
VEX
Title
FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing
Summary
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_event_expand_headers_check() advanced beyond its heap copy when a positive offset in ${variable:offset} exceeded the variable value's length. The following length calculation and copy appended adjacent heap memory to the expansion result, potentially exposing channel variables, credentials, allocator data, and pointer bytes. The flaw is reachable through configuration templates that slice remote input and through authenticated Event Socket eval or Event Socket expand commands; the separate channel-variable expander used by ordinary dialplan slicing is unaffected. The requester cannot choose adjacent memory and disclosure stops at a zero byte, but repeated expansion can influence the layout. This issue is fixed in version 1.11.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 18:06 UTC
CWE
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/signalwire/freeswitch/security… | x_refsource_CONFIRM |
| https://github.com/signalwire/freeswitch/commit/3… | x_refsource_MISC |
| https://github.com/signalwire/freeswitch/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| signalwire | freeswitch |
Affected:
< 1.11.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116780",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T18:06:15.492102Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:07:03.674Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "freeswitch",
"vendor": "signalwire",
"versions": [
{
"status": "affected",
"version": "\u003c 1.11.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_event_expand_headers_check() advanced beyond its heap copy when a positive offset in ${variable:offset} exceeded the variable value\u0027s length. The following length calculation and copy appended adjacent heap memory to the expansion result, potentially exposing channel variables, credentials, allocator data, and pointer bytes. The flaw is reachable through configuration templates that slice remote input and through authenticated Event Socket eval or Event Socket expand commands; the separate channel-variable expander used by ordinary dialplan slicing is unaffected. The requester cannot choose adjacent memory and disclosure stops at a zero byte, but repeated expansion can influence the layout. This issue is fixed in version 1.11.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T19:34:21.327Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-2p6g-9c8q-232p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-2p6g-9c8q-232p"
},
{
"name": "https://github.com/signalwire/freeswitch/commit/30cdb387ae0fac0cbbeb6ac05416aaffb9252258",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/signalwire/freeswitch/commit/30cdb387ae0fac0cbbeb6ac05416aaffb9252258"
},
{
"name": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.2"
}
],
"source": {
"advisory": "GHSA-2p6g-9c8q-232p",
"discovery": "UNKNOWN"
},
"title": "FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-116780",
"datePublished": "2026-11-05T19:34:21.327Z",
"dateReserved": "2026-10-26T21:53:35.166Z",
"dateUpdated": "2026-11-09T18:07:03.674Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116744 (GCVE-0-2026-116744)
Vulnerability from cvelistv5 – Published: 2026-10-26 21:52 – Updated: 2026-10-31 02:01
VLAI
EPSS
VEX
Title
ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector
Summary
ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-31 02:01 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/ntop/nDPI/pull/3298 | issue-trackingpatch |
| https://github.com/ntop/nDPI/commit/ca9d819151606… | patch |
| https://github.com/ntop/nDPI | product |
| https://github.com/ntop/nDPI/blob/6.0/src/lib/pro… | technical-description |
| https://hackmd.io/@haindpwn/ndpi-softether-host-f… | third-party-advisory |
| https://github.com/ntop/nDPI/issues/3291 | issue-tracking |
| https://www.vulncheck.com/advisories/ntop-ndpi-th… | third-party-advisory |
Impacted products
Date Public
2026-10-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116744",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-31T02:01:44.690073Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T02:01:54.934Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ntop/ndpi",
"product": "nDPI",
"repo": "https://github.com/ntop/nDPI",
"vendor": "ntop",
"versions": [
{
"lessThanOrEqual": "6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ntop:ndpi:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
},
{
"lang": "en",
"type": "remediation developer",
"value": "IvanNardi"
}
],
"datePublic": "2026-10-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T21:52:42.875Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #3298",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/ntop/nDPI/pull/3298"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ntop/nDPI/commit/ca9d819151606377ac53305583fe819748c69be2"
},
{
"tags": [
"product"
],
"url": "https://github.com/ntop/nDPI"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ntop/nDPI/blob/6.0/src/lib/protocols/softether.c#L203"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/ndpi-softether-host-fqdn-strncmp-oob-read"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/ntop/nDPI/issues/3291"
},
{
"name": "VulnCheck Advisory: ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ntop-ndpi-through-6.0-out-of-bounds-read-in-softether-dissector"
}
],
"title": "ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116744",
"datePublished": "2026-10-26T21:52:42.875Z",
"dateReserved": "2026-10-26T20:23:36.908Z",
"dateUpdated": "2026-10-31T02:01:54.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116736 (GCVE-0-2026-116736)
Vulnerability from cvelistv5 – Published: 2026-10-26 21:52 – Updated: 2026-10-31 02:00
VLAI
EPSS
VEX
Title
libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array
Summary
Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-31 02:00 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/libyal/libpff/issues/172 | issue-tracking |
| https://github.com/libyal/libpff | product |
| https://github.com/libyal/libpff/commit/cb83eb38f… | patch |
| https://github.com/libyal/libpff/blob/20260926/li… | technical-description |
| https://hackmd.io/@haindpwn/libpff-table-parsing-… | third-party-advisory |
| https://www.vulncheck.com/advisories/libpff-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116736",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-31T02:00:05.386314Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T02:00:14.554Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/libyal/libpff",
"product": "libpff",
"repo": "https://github.com/libyal/libpff",
"vendor": "libyal",
"versions": [
{
"lessThanOrEqual": "20260926",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:libpff_project:libpff:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition\u0027s values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T10:14:07.473Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #172",
"tags": [
"issue-tracking"
],
"url": "https://github.com/libyal/libpff/issues/172"
},
{
"tags": [
"product"
],
"url": "https://github.com/libyal/libpff"
},
{
"tags": [
"patch"
],
"url": "https://github.com/libyal/libpff/commit/cb83eb38ffdbdfe2c69238fe7ce481ddc8513266"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/libyal/libpff/blob/20260926/libpff/libpff_table.c#L8858-L8895"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libpff-table-parsing-oob-reads"
},
{
"name": "VulnCheck Advisory: libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libpff-through-20260926-heap-out-of-bounds-read-via-libpff-table-read-values-array"
}
],
"title": "libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116736",
"datePublished": "2026-10-26T21:52:36.380Z",
"dateReserved": "2026-10-26T20:23:35.811Z",
"dateUpdated": "2026-10-31T02:00:14.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.