CWE-125: Out-of-bounds Read — known CVE vulnerabilities

CVEs classified under CWE-125 (Out-of-bounds Read), ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (50)

• CVE-2026-24826: Out-of-bounds Write, Divide By Zero, NULL Pointer Dereference, Use of Uninitialized Resource, Out-of-bounds Read, Reachable Assertion…
• CVE-2024-22004 — CVSS 10.0 (critical): Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a vulnerability and leak the…
• CVE-2021-41556 — CVSS 10.0 (critical): sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code…
• CVE-2021-21777 — CVSS 10.0 (critical): An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2.3 and development…
• CVE-2017-14451 — CVSS 10.0 (critical): An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A specially crafted smart…
• CVE-2013-0767 — CVSS 10.0 (critical): The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1…
• CVE-2009-2523 — CVSS 10.0 (critical): The License Logging Server (llssrv.exe) in Microsoft Windows 2000 SP4 allows remote attackers to execute arbitrary code via an RPC message…
• CVE-2026-33642 — CVSS 9.9 (critical): Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c…
• CVE-2026-34987 — CVSS 9.9 (critical): Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default…
• CVE-2023-28445 — CVSS 9.9 (critical): Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions…
• CVE-2023-26489 — CVSS 9.9 (critical): wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64…
• CVE-2026-71256 — CVSS 9.8 (critical): nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic /…
• CVE-2026-64762 — CVSS 9.8 (critical): An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia…
• CVE-2026-43809 — CVSS 9.8 (critical): An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia…
• CVE-2026-43773 — CVSS 9.8 (critical): An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS…
• CVE-2026-43757 — CVSS 9.8 (critical): An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia…
• CVE-2026-59147 — CVSS 9.8 (critical): Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find…
• CVE-2026-64102 — CVSS 9.8 (critical): In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A…
• CVE-2025-15646 — CVSS 9.8 (critical): HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo…
• CVE-2026-52955 — CVSS 9.8 (critical): In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message…
• CVE-2026-29013 — CVSS 9.8 (critical): libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in…
• CVE-2026-31405 — CVSS 9.8 (critical): In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The…
• CVE-2026-33669 — CVSS 9.8 (critical): SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface…
• CVE-2026-3055 — CVSS 9.8 (critical) — actively exploited: Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
• CVE-2026-2771 — CVSS 9.8 (critical): Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8…
• CVE-2026-3062 — CVSS 9.8 (critical): Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds…
• CVE-2026-22984 — CVSS 9.8 (critical): In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done()…
• CVE-2025-69992 — CVSS 9.8 (critical): phpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the…
• CVE-2025-55086 — CVSS 9.8 (critical): In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked…
• CVE-2025-57052 — CVSS 9.8 (critical): cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote…
• CVE-2025-54950 — CVSS 9.8 (critical): An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code…
• CVE-2025-38139 — CVSS 9.8 (critical): In the Linux kernel, the following vulnerability has been resolved: netfs: Fix oops in write-retry from mis-resetting the subreq iterator…
• CVE-2025-4918 — CVSS 9.8 (critical): An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox…
• CVE-2025-37879 — CVSS 9.8 (critical): In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative read/write replies In…
• CVE-2025-30458 — CVSS 9.8 (critical): A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to read files…
• CVE-2025-24265 — CVSS 9.8 (critical): An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS…
• CVE-2025-24256 — CVSS 9.8 (critical): The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5…
• CVE-2025-24230 — CVSS 9.8 (critical): An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6…
• CVE-2024-11131 — CVSS 9.8 (critical): A vulnerability regarding out-of-bounds read is found in the video interface. This allows remote attackers to execute arbitrary code via…
• CVE-2025-29913 — CVSS 9.8 (critical): CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure…
• CVE-2022-49407 — CVSS 9.8 (critical): In the Linux kernel, the following vulnerability has been resolved: dlm: fix plock invalid read This patch fixes an invalid read showed by…
• CVE-2022-49094 — CVSS 9.8 (critical): In the Linux kernel, the following vulnerability has been resolved: net/tls: fix slab-out-of-bounds bug in decrypt_internal The memory size…
• CVE-2024-54506 — CVSS 9.8 (critical): An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.2. An attacker may be…
• CVE-2017-17772 — CVSS 9.8 (critical): In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation.
• CVE-2024-11403 — CVSS 9.8 (critical): There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used…
• CVE-2024-32659 — CVSS 9.8 (critical): FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to…
• CVE-2024-32658 — CVSS 9.8 (critical): FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to…
• CVE-2024-32459 — CVSS 9.8 (critical): FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to…
• CVE-2024-32458 — CVSS 9.8 (critical): FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or…
• CVE-2024-32041 — CVSS 9.8 (critical): FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or…