CWE-125: Out-of-bounds read
10,635 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 19 of them as exploited in the wild.
- Published CVEs
- 10,635
- Last 12 months
- 2,707
- Critical
- 764
- Known exploited
- 19
Critical 764High 4,238Medium 4,885Low 739Not scored 9
CVEs per yearBy the year they were published
- 20154
- 201690
- 2017710
- 2018768
- 2019908
- 2020672
- 2021729
- 2022864
- 2023991
- 20241,227
- 2025998
- 20262,602
Known exploitedNewest addition to KEV first
- CVE-2026-11645
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…
Google · Chrome
ExploitedHigh8.8 - CVE-2023-36424
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Microsoft · Windows 11 version 22H3
ExploitedHigh7.8 - CVE-2026-3055
Insufficient input validation leading to memory overread
NetScaler · ADC
ExploitedCritical9.3 - CVE-2025-5777
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
NetScaler · ADC
ExploitedCritical9.3 - CVE-2025-5419
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
Google · Chrome
ExploitedHigh8.8 - CVE-2024-53150
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
Linux · Linux
ExploitedHigh7.1 - CVE-2025-24991
Windows NTFS Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedMedium5.5 - CVE-2025-22226
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with…
ESXi
ExploitedHigh7.1 - CVE-2024-0519
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
Google · Chrome
ExploitedHigh8.8 - CVE-2023-42916
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2.…
Apple · Safari
ExploitedMedium6.5
Newest CVEs
- CVE-2026-124312
Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo
fraunhoferhhi · vvdec
Medium5.7 - CVE-2026-124309
Fraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalableNesting
fraunhoferhhi · vvdec
Medium6.9 - CVE-2026-104254
liboqs: Heap out-of-bounds read in LMS/HSS signature verification via unvalidated signature length (hss_verify_inc.c:215)
open-quantum-safe · liboqs
Medium5.3 - CVE-2026-119924
Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser
AWS · babelfish-for-postgresql
High7.2 - CVE-2026-73471
Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux nikon metadata tag parsing
GStreamer · gst-plugins-good
Medium6.1 - CVE-2026-123269
libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds
libyal · libvmdk
Medium4.8 - CVE-2026-92698
FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read
pavel-odintsov · fastnetmon
High8.2 - CVE-2026-92697
FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read
pavel-odintsov · fastnetmon
High7.5 - CVE-2026-92693
FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser
pavel-odintsov · fastnetmon
High8.2 - CVE-2026-92695
FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read on truncated frames
pavel-odintsov · fastnetmon
High8.2