CWE-125

{
  "affected": [],
  "aliases": [
    "CVE-2018-12849"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-09-25T13:29:00Z",
    "severity": "HIGH"
  },
  "details": "Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.",
  "id": "GHSA-frxr-qfwc-3mv7",
  "modified": "2022-05-13T01:28:13Z",
  "published": "2022-05-13T01:28:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12849"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb18-34.html"
    },
    {
      "type": "WEB",
      "url": "https://research.checkpoint.com/2018/50-adobe-cves-in-50-days"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/105358"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1041702"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-35532"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-07T20:15:29Z",
    "severity": "CRITICAL"
  },
  "details": "An XML External Entity (XXE) injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service (DoS) via unspecified vectors.",
  "id": "GHSA-fv2q-p9cw-m9w5",
  "modified": "2025-01-08T15:31:10Z",
  "published": "2025-01-07T21:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35532"
    },
    {
      "type": "WEB",
      "url": "https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2024-35532.pdf"
    },
    {
      "type": "WEB",
      "url": "https://intersec.com/public-safety"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-62743"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-11T17:18:26Z",
    "severity": "MODERATE"
  },
  "details": "Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally.",
  "id": "GHSA-fv2r-f2w7-vx86",
  "modified": "2026-08-11T18:31:18Z",
  "published": "2026-08-11T18:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62743"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62743"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-20902"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-20T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 during computation of the denominator of pseudo-normalized correlation R\u0027(0), that could result in disclosure of information.",
  "id": "GHSA-fv2v-8v2v-g9q3",
  "modified": "2022-05-24T19:15:15Z",
  "published": "2022-05-24T19:15:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-20902"
    },
    {
      "type": "WEB",
      "url": "https://trac.ffmpeg.org/ticket/8176"
    },
    {
      "type": "WEB",
      "url": "http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=0c61661a2cbe1b8b284c80ada1c2fdddf4992cad"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-64202"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T17:17:59Z",
    "severity": "HIGH"
  },
  "details": "There is a memory corruption vulnerability recently\ndiscovered in NI LabVIEW that may result in information disclosure or arbitrary\ncode execution.\u00a0 Successful exploitation requires an attacker to get a\nuser to open a specially crafted VI.\u00a0 This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0)\nand prior versions.",
  "id": "GHSA-fv2w-vfhx-4hvc",
  "modified": "2026-08-25T18:31:56Z",
  "published": "2026-08-25T18:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64202"
    },
    {
      "type": "WEB",
      "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/memory-corruption-vulnerabilities-ni-labview.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-70330"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-11T15:16:23Z",
    "severity": "LOW"
  },
  "details": "Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP gradebook files. By modifying specific fields at precise offsets within an otherwise valid .EGP file, an attacker can trigger an out-of-bounds memory read during parsing. This results in an unhandled access violation and application crash, leading to a local denial-of-service condition when the crafted file is opened by a user.",
  "id": "GHSA-fv6j-m5gr-7r2x",
  "modified": "2026-03-11T15:31:52Z",
  "published": "2026-03-11T15:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70330"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TheMalwareGuardian/CVE-2025-70330"
    },
    {
      "type": "WEB",
      "url": "http://easy.com"
    },
    {
      "type": "WEB",
      "url": "http://orbis.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-15890"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-07-21T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "LuaJit through 2.1.0-beta3 has an out-of-bounds read because __gc handler frame traversal is mishandled.",
  "id": "GHSA-fv6p-x8x2-5jcc",
  "modified": "2025-11-03T21:30:31Z",
  "published": "2022-05-24T17:24:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15890"
    },
    {
      "type": "WEB",
      "url": "https://github.com/LuaJIT/LuaJIT/issues/601"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00026.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00022.html"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4501-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-9935"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-01-04T20:59:00Z",
    "severity": "CRITICAL"
  },
  "details": "The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document.",
  "id": "GHSA-fv6v-3mxr-qrg2",
  "modified": "2022-05-14T03:27:42Z",
  "published": "2022-05-14T03:27:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9935"
    },
    {
      "type": "WEB",
      "url": "https://github.com/php/php-src/commit/66fd44209d5ffcb9b3d1bc1b9fd8e35b485040c0"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:1296"
    },
    {
      "type": "WEB",
      "url": "https://bugs.php.net/bug.php?id=73631"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201702-29"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00142.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2017-01/msg00054.html"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2016/dsa-3737"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/12/12/2"
    },
    {
      "type": "WEB",
      "url": "http://www.php.net/ChangeLog-5.php"
    },
    {
      "type": "WEB",
      "url": "http://www.php.net/ChangeLog-7.php"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/94846"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-49706"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:46Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nzonefs: fix zonefs_iomap_begin() for reads\n\nIf a readahead is issued to a sequential zone file with an offset\nexactly equal to the current file size, the iomap type is set to\nIOMAP_UNWRITTEN, which will prevent an IO, but the iomap length is\ncalculated as 0. This causes a WARN_ON() in iomap_iter():\n\n[17309.548939] WARNING: CPU: 3 PID: 2137 at fs/iomap/iter.c:34 iomap_iter+0x9cf/0xe80\n[...]\n[17309.650907] RIP: 0010:iomap_iter+0x9cf/0xe80\n[...]\n[17309.754560] Call Trace:\n[17309.757078]  \u003cTASK\u003e\n[17309.759240]  ? lock_is_held_type+0xd8/0x130\n[17309.763531]  iomap_readahead+0x1a8/0x870\n[17309.767550]  ? iomap_read_folio+0x4c0/0x4c0\n[17309.771817]  ? lockdep_hardirqs_on_prepare+0x400/0x400\n[17309.778848]  ? lock_release+0x370/0x750\n[17309.784462]  ? folio_add_lru+0x217/0x3f0\n[17309.790220]  ? reacquire_held_locks+0x4e0/0x4e0\n[17309.796543]  read_pages+0x17d/0xb60\n[17309.801854]  ? folio_add_lru+0x238/0x3f0\n[17309.807573]  ? readahead_expand+0x5f0/0x5f0\n[17309.813554]  ? policy_node+0xb5/0x140\n[17309.819018]  page_cache_ra_unbounded+0x27d/0x450\n[17309.825439]  filemap_get_pages+0x500/0x1450\n[17309.831444]  ? filemap_add_folio+0x140/0x140\n[17309.837519]  ? lock_is_held_type+0xd8/0x130\n[17309.843509]  filemap_read+0x28c/0x9f0\n[17309.848953]  ? zonefs_file_read_iter+0x1ea/0x4d0 [zonefs]\n[17309.856162]  ? trace_contention_end+0xd6/0x130\n[17309.862416]  ? __mutex_lock+0x221/0x1480\n[17309.868151]  ? zonefs_file_read_iter+0x166/0x4d0 [zonefs]\n[17309.875364]  ? filemap_get_pages+0x1450/0x1450\n[17309.881647]  ? __mutex_unlock_slowpath+0x15e/0x620\n[17309.888248]  ? wait_for_completion_io_timeout+0x20/0x20\n[17309.895231]  ? lock_is_held_type+0xd8/0x130\n[17309.901115]  ? lock_is_held_type+0xd8/0x130\n[17309.906934]  zonefs_file_read_iter+0x356/0x4d0 [zonefs]\n[17309.913750]  new_sync_read+0x2d8/0x520\n[17309.919035]  ? __x64_sys_lseek+0x1d0/0x1d0\n\nFurthermore, this causes iomap_readahead() to loop forever as\niomap_readahead_iter() always returns 0, making no progress.\n\nFix this by treating reads after the file size as access to holes,\nsetting the iomap type to IOMAP_HOLE, the iomap addr to IOMAP_NULL_ADDR\nand using the length argument as is for the iomap length. To simplify\nthe code with this change, zonefs_iomap_begin() is split into the read\nvariant, zonefs_read_iomap_begin() and zonefs_read_iomap_ops, and the\nwrite variant, zonefs_write_iomap_begin() and zonefs_write_iomap_ops.",
  "id": "GHSA-fv86-c5hh-rvpj",
  "modified": "2025-10-24T18:30:57Z",
  "published": "2025-10-24T18:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49706"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/355be6131164c5bacf2e810763835aecb6e01fcb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3a7f05f104347b407e865c10be2675cd833a4e48"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c1c1204c0d0c1dccc1310b9277fb2bd8b663d8fe"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c2f71b9bb398e2e573bdc2574149f42b45efe410"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-5512"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-22T20:15:09Z",
    "severity": "LOW"
  },
  "details": "Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22021.",
  "id": "GHSA-fv97-c4gc-26hq",
  "modified": "2024-11-22T21:32:16Z",
  "published": "2024-11-22T21:32:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5512"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-555"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}