← Back
CWE-119

14,074 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

JSON object

Loading...

CVEs (14,074)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
3Linux
NetappRedhat
7Enterprise Linux
H300s FirmwareH410c Firmware+4 more
Jun 17, 2026
Sep 9, 2022
N/A· v4
7.8 HIGH· v3
N/A· v2
A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
1Rust Osdev
1Linked List Allocator
Jun 17, 2026
Sep 7, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-boun...Show more
linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than `3 * size_of::<usize>` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method. Version 0.10.2 contains a patch for the issue. As a workaround, ensure that the heap is only initialized with a size larger than `3 * size_of::<usize>` and that the `Heap::extend` method is only called with sizes larger than `2 * size_of::<usize>()`. Also, ensure that the total heap size is (and stays) a multiple of `2 * size_of::<usize>()`.Show less
2Gnu
Redhat
2Enterprise Linux
Fribidi
Jun 17, 2026
Sep 6, 2022
N/A· v4
5.5 MEDIUM· v3
N/A· v2
A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi,...Show more
A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi, leading to a crash and causing a denial of service.Show less
1Qualcomm
145Apq8009 Firmware
Apq8009w FirmwareApq8017 Firmware+142 more
Jun 17, 2026
Sep 2, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Memory corruption due to incorrect pointer arithmetic when attempting to change the endianness in video parser function in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon...Show more
Memory corruption due to incorrect pointer arithmetic when attempting to change the endianness in video parser function in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon WearablesShow less
1Qualcomm
19Apq8096au Firmware
Msm8996au FirmwareQam8295p Firmware+16 more
Jun 17, 2026
Sep 2, 2022
N/A· v4
7.8 HIGH· v3
N/A· v2
Memory corruption in multimedia due to improper check on the messages received. in Snapdragon Auto
1Qualcomm
1Apq8096au Firmware
Jun 17, 2026
Sep 2, 2022
N/A· v4
7.8 HIGH· v3
N/A· v2
Memory corruption in multimedia driver due to untrusted pointer dereference while reading data from socket in Snapdragon Auto
2Fedoraproject
Gnu
2Fedora
Gcc
Jun 17, 2026
Sep 1, 2022
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.
2Netapp
Sqlite
2Ontap Select Deploy Administration Utility
Sqlite
Jun 17, 2026
Sep 1, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.
5Debian
FedoraprojectLibtiff+2 more
5Debian Linux
Enterprise LinuxFedora+2 more
Jun 17, 2026
Aug 31, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting...Show more
A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service.Show less
1Imagemagick
1Imagemagick
Jun 17, 2026
Aug 29, 2022
N/A· v4
5.5 MEDIUM· v3
N/A· v2
A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered when an attacker passes a specially crafted TIFF image file to ImageMagick for c...Show more
A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered when an attacker passes a specially crafted TIFF image file to ImageMagick for conversion, potentially leading to a denial of service.Show less
1Openscad
1Openscad
Jun 17, 2026
Aug 29, 2022
N/A· v4
5.5 MEDIUM· v3
N/A· v2
A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-of-bounds memory access when imported using import().
3Debian
FedoraprojectLibmodbus
4Debian Linux
Extra Packages For Enterprise LinuxFedora+1 more
Jun 17, 2026
Aug 29, 2022
N/A· v4
7.8 HIGH· v3
N/A· v2
A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.
1Upx
1Upx
Jun 17, 2026
Aug 25, 2022
N/A· v4
5.5 MEDIUM· v3
N/A· v2
An floating point exception was discovered in the elf_lookup function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file.
1Upx
1Upx
Jun 17, 2026
Aug 25, 2022
N/A· v4
7.8 HIGH· v3
N/A· v2
A heap-based buffer over-read was discovered in the get_le64 function in bele.h in UPX 4.0.0 via a crafted Mach-O file.
1Upx
1Upx
Jun 17, 2026
Aug 25, 2022
N/A· v4
7.8 HIGH· v3
N/A· v2
A heap-based buffer over-read was discovered in the get_le32 function in bele.h in UPX 4.0.0 via a crafted Mach-O file.
1Upx
1Upx
Jun 17, 2026
Aug 25, 2022
N/A· v4
7.8 HIGH· v3
N/A· v2
A heap-based buffer over-read was discovered in the acc_ua_get_be32 function in miniacc.h in UPX 4.0.0 via a crafted Mach-O file.
1Upx
1Upx
Jun 17, 2026
Aug 25, 2022
N/A· v4
5.5 MEDIUM· v3
N/A· v2
An invalid memory address reference was discovered in the adjABS function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file.
1Upx
1Upx
Jun 17, 2026
Aug 25, 2022
N/A· v4
5.5 MEDIUM· v3
N/A· v2
An invalid memory address reference was discovered in the elf_lookup function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file.
1Upx
1Upx
Jun 17, 2026
Aug 25, 2022
N/A· v4
7.8 HIGH· v3
N/A· v2
A heap-based buffer over-read was discovered in the invert_pt_dynamic function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file.
1Apple
6Ipados
Iphone OsMac Os X+3 more
Jun 17, 2026
Aug 24, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 15.6 and iPadOS 15.6, tvOS 15.6, watchOS 8.7. A remote user ma...Show more
The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 15.6 and iPadOS 15.6, tvOS 15.6, watchOS 8.7. A remote user may cause an unexpected app termination or arbitrary code execution.Show less