CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
2,753 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-87489 — Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitra
- CVE-2026-87444 — Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code
- CVE-2026-79069 — Memory corruption in Tint in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially exe
- CVE-2026-34159 — llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backend
- CVE-2026-5350 — Trendnet TEW-657BRM setup.cgi update_pcdb stack-based overflow
- CVE-2026-5349 — Trendnet TEW-657BRM setup.cgi add_apcdb stack-based overflow
- CVE-2026-5214 — D-Link DNS-1550-04 account_mgr.cgi cgi_addgroup_get_group_quota_minsize stack-based overflow
- CVE-2026-5213 — D-Link DNS-1550-04 account_mgr.cgi cgi_adduser_to_session stack-based overflow
- CVE-2026-5212 — D-Link DNS-1550-04 webdav_mgr.cgi Webdav_Upload_File stack-based overflow
- CVE-2026-5211 — D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Del stack-based overflow
- CVE-2026-5204 — Tenda CH22 Parameter webtypelibrary formWebTypeLibrary stack-based overflow
- CVE-2026-5156 — Tenda CH22 Parameter QuickIndex formQuickIndex stack-based overflow
- CVE-2026-5155 — Tenda CH22 Parameter AdvSetWan fromAdvSetWan stack-based overflow
- CVE-2026-5154 — Tenda CH22 Parameter setcfm fromSetCfm stack-based overflow
- CVE-2026-5152 — Tenda CH22 createFileName formCreateFileName stack-based overflow
- CVE-2026-5046 — Tenda FH1201 Parameter WrlExtraSet formWrlExtraSet stack-based overflow
- CVE-2026-5045 — Tenda FH1201 Parameter WrlclientSet stack-based overflow
- CVE-2026-5044 — Belkin F9K1122 Setting formSetSystemSettings stack-based overflow
- CVE-2026-5043 — Belkin F9K1122 Parameter formSetPassword stack-based overflow
- CVE-2026-5042 — Belkin F9K1122 Parameter formCrossBandSwitch stack-based overflow
Recently published
- CVE-2026-87933 — DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
- CVE-2026-87931 — Behavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflow
- CVE-2026-87489 — Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitra
- CVE-2026-87444 — Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code
- CVE-2026-86716 — Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow
- CVE-2026-86514 — vgmstream txth-txtp txth.c sscanf stack-based overflow
- CVE-2026-86510 — D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write
- CVE-2026-86509 — D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow
- CVE-2026-86318 — java-json-tools json-patch JsonMergePatchDeserializer.java JsonMergePatch.fromJson stack-based overflow
- CVE-2026-86303 — 92181 markdown md.c lds out-of-bounds
- CVE-2026-86296 — D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow
- CVE-2026-86288 — ModelCloud GPTQModel Triton dequantization kernel tritonv2.py out-of-bounds
- CVE-2026-86227 — valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds
- CVE-2026-86166 — Tenda HG10 Boa Web Server formWanRedirect buffer overflow
- CVE-2026-86165 — Tenda HG10 formURL buffer overflow
- CVE-2026-85522 — valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds
- CVE-2026-85110 — Tenda HG10 Boa Web Server formWlanSetup buffer overflow
- CVE-2026-85109 — Tenda HG10 Boa Web Server formLogin buffer overflow
- CVE-2026-85031 — TOTOLINK CP450 cstecgi.cgi buffer overflow
- CVE-2026-9637 — CompactLogix® 5380 / ControlLogix® 5580 - Multiple Vulnerabilities
More specific weaknesses
- CWE-125 — Out-of-bounds Read
- CWE-466 — Return of Pointer Value Outside of Expected Range
- CWE-786 — Access of Memory Location Before Start of Buffer
- CWE-787 — Out-of-bounds Write
- CWE-788 — Access of Memory Location After End of Buffer
- CWE-805 — Buffer Access with Incorrect Length Value
- CWE-822 — Untrusted Pointer Dereference
- CWE-823 — Use of Out-of-range Pointer Offset
- CWE-824 — Access of Uninitialized Pointer
- CWE-825 — Expired Pointer Dereference