Common Weakness Enumeration
CWE-126
AllowedBuffer Over-read
Abstraction: Variant · Status: Draft
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
1049 vulnerabilities reference this CWE, most recent first.
GHSA-5VHQ-WV6W-VJ48
Vulnerability from github – Published: 2022-08-18 00:00 – Updated: 2026-02-25 15:31
VLAI
Details
Buffer Over-read in GitHub repository vim/vim prior to 9.0.0217.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-2845"
],
"database_specific": {
"cwe_ids": [
"CWE-126",
"CWE-1284"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-17T15:15:00Z",
"severity": "HIGH"
},
"details": "Buffer Over-read in GitHub repository vim/vim prior to 9.0.0217.",
"id": "GHSA-5vhq-wv6w-vj48",
"modified": "2026-02-25T15:31:35Z",
"published": "2022-08-18T00:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2845"
},
{
"type": "WEB",
"url": "https://github.com/vim/vim/commit/e98c88c44c308edaea5994b8ad4363e65030968c"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/3e1d31ac-1cfd-4a9f-bc5c-213376b69445"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202305-16"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5VVW-9383-FWX7
Vulnerability from github – Published: 2026-10-16 18:34 – Updated: 2026-10-19 18:32
VLAI
Details
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-46471"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T16:18:11Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin\u0027s qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.",
"id": "GHSA-5vvw-9383-fwx7",
"modified": "2026-10-19T18:32:05Z",
"published": "2026-10-16T18:34:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46471"
},
{
"type": "WEB",
"url": "https://github.com/atredispartners/advisories/blob/master/2026/ATREDIS-2026-0004.md"
},
{
"type": "WEB",
"url": "https://gstreamer.freedesktop.org/security/sa-2026-0002.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5VW9-RC6M-4RR9
Vulnerability from github – Published: 2026-09-08 18:32 – Updated: 2026-09-08 18:32
VLAI
Details
Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-69794"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T18:19:51Z",
"severity": "MODERATE"
},
"details": "Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.",
"id": "GHSA-5vw9-rc6m-4rr9",
"modified": "2026-09-08T18:32:59Z",
"published": "2026-09-08T18:32:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69794"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69794"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5WM9-V2RG-4WX7
Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2024-07-01 15:32
VLAI
Details
Transient DOS while loading the TA ELF file.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2024-21462"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-01T15:15:14Z",
"severity": "HIGH"
},
"details": "Transient DOS while loading the TA ELF file.",
"id": "GHSA-5wm9-v2rg-4wx7",
"modified": "2024-07-01T15:32:43Z",
"published": "2024-07-01T15:32:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21462"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5WR8-59H9-379R
Vulnerability from github – Published: 2026-10-13 21:35 – Updated: 2026-10-13 21:35
VLAI
Details
Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-85835"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T19:21:09Z",
"severity": "MODERATE"
},
"details": "Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally.",
"id": "GHSA-5wr8-59h9-379r",
"modified": "2026-10-13T21:35:59Z",
"published": "2026-10-13T21:35:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85835"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85835"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5X7V-734M-RMX2
Vulnerability from github – Published: 2026-10-13 21:34 – Updated: 2026-10-13 21:34
VLAI
Details
Buffer over-read in Desktop Window Manager allows an authorized attacker to disclose information locally.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-70234"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T19:19:39Z",
"severity": "MODERATE"
},
"details": "Buffer over-read in Desktop Window Manager allows an authorized attacker to disclose information locally.",
"id": "GHSA-5x7v-734m-rmx2",
"modified": "2026-10-13T21:34:15Z",
"published": "2026-10-13T21:34:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70234"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70234"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5XPV-76M7-FC52
Vulnerability from github – Published: 2026-09-17 06:30 – Updated: 2026-09-17 06:30
VLAI
Details
Information Disclosure when a pointer is reused after being deallocated.
Severity
7.3 (High)
{
"affected": [],
"aliases": [
"CVE-2026-25284"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T05:17:01Z",
"severity": "HIGH"
},
"details": "Information Disclosure when a pointer is reused after being deallocated.",
"id": "GHSA-5xpv-76m7-fc52",
"modified": "2026-09-17T06:30:33Z",
"published": "2026-09-17T06:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25284"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2026-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-6254-2RG3-FF99
Vulnerability from github – Published: 2026-09-08 18:32 – Updated: 2026-09-08 18:32
VLAI
Details
Buffer over-read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-69582"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T18:19:27Z",
"severity": "HIGH"
},
"details": "Buffer over-read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-6254-2rg3-ff99",
"modified": "2026-09-08T18:32:46Z",
"published": "2026-09-08T18:32:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69582"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69582"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-63F6-CJXM-WF36
Vulnerability from github – Published: 2024-06-11 18:30 – Updated: 2024-06-11 18:30
VLAI
Details
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Severity
4.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-30069"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-11T17:15:53Z",
"severity": "MODERATE"
},
"details": "Windows Remote Access Connection Manager Information Disclosure Vulnerability",
"id": "GHSA-63f6-cjxm-wf36",
"modified": "2024-06-11T18:30:48Z",
"published": "2024-06-11T18:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30069"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30069"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-642H-GGVV-J2C4
Vulnerability from github – Published: 2025-09-08 15:37 – Updated: 2025-09-08 15:37
VLAI
Details
A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read.
Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.11 & <= 9.0.0 as represented in CVE-2025-21176.
Additionally, if you've deployed self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.
NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-36855"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-08T14:15:34Z",
"severity": "HIGH"
},
"details": "A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll\u00a0due to buffer over-read.\n\n Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.\n\n This issue affects EOL ASP.NET 6.0.0 \u003c= 6.0.36 as represented in this CVE, as well as 8.0.0 \u003c= 8.0.11 \u0026 \u003c= 9.0.0 as represented in\u00a0CVE-2025-21176.\n\n \n\n Additionally, if you\u0027ve deployed self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd \u00a0targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n NOTE:\u00a0This CVE affects only End Of Life (EOL)\u00a0software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.",
"id": "GHSA-642h-ggvv-j2c4",
"modified": "2025-09-08T15:37:44Z",
"published": "2025-09-08T15:37:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36855"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21176"
},
{
"type": "WEB",
"url": "https://www.herodevs.com/vulnerability-directory/cve-2025-21176"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.