CWE-126: Buffer Over-read
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
504 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2024-38373 — FreeRTOS-Plus-TCP Buffer Over-Read in DNS Response Parser
- CVE-2025-60003 — Junos OS and Junos OS Evolved: BGP update with a set of specific attributes causes rpd crash
- CVE-2024-33056 — Buffer Over-read in MProc
- CVE-2024-33047 — Buffer Over-read in Display
- CVE-2025-21488 — Buffer Over-read in Data Network Stack & Connectivity
- CVE-2025-21487 — Buffer Over-read in Data Network Stack & Connectivity
- CVE-2025-21484 — Buffer Over-read in Data Network Stack & Connectivity
- CVE-2025-21427 — Buffer Over-read in Data HLOS - LNX
- CVE-2024-53026 — Buffer Over-read in Data Network Stack & Connectivity
- CVE-2024-53021 — Buffer Over-read in Data Network Stack & Connectivity
- CVE-2024-53020 — Buffer Over-read in Data Network Stack & Connectivity
- CVE-2024-53019 — Buffer Over-read in Data Network Stack & Connectivity
- CVE-2024-49846 — Buffer Over-read in Multi-Mode Call Processor
- CVE-2024-49839 — Buffer Over-read in WLAN Host Cmn
- CVE-2024-49838 — Buffer Over-read in WLAN HOST
- CVE-2024-33073 — Buffer Over-read in WLAN Host Communication
- CVE-2024-33064 — Buffer Over-read in WLAN Host Communication
- CVE-2024-23359 — Buffer Over-read in Multi Mode Call Processor
- CVE-2025-59600 — Buffer Over-read in Graphics
- CVE-2025-47368 — Buffer Over-read in DSP Service
Recently published
- CVE-2026-18238 — OOBR in rpcap client in libpcap before 1.10.7
- CVE-2026-70652 — libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map
- CVE-2026-53587 — libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data
- CVE-2026-76885 — Buffer Over-read in Wireshark
- CVE-2026-76884 — Buffer Over-read in Wireshark
- CVE-2026-65936 — RS9116W/SiWx917 malformed packet with increased length field causes memory leak
- CVE-2026-65933 — BT122 malformed packet with increased length field causes memory leak
- CVE-2026-18024 — PostgreSQL ascii() function reads past end of buffer
- CVE-2026-14678 — PostgreSQL pg_trgm picksplit reads past end of buffer
- CVE-2026-53414 — Zoom Clients - Buffer Over-read
- CVE-2026-20311 — Cisco IOS XE Software Web UI Denial of Service Vulnerability
- CVE-2026-25288 — Buffer Over-read in WLAN Firmware
- CVE-2026-55970 — Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
- CVE-2026-55238 — xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads
- CVE-2026-63091 — ProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parser
- CVE-2026-47088 — An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsi
- CVE-2026-62353 — TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToken
- CVE-2026-49854 — Tornado: Out-of-bounds memory access in C extension
- CVE-2026-59840 — A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all v
- CVE-2025-43892 — A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all v