Common Weakness Enumeration
CWE-126
AllowedBuffer Over-read
Abstraction: Variant · Status: Draft
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
980 vulnerabilities reference this CWE, most recent first.
GHSA-8FC7-45X6-26P6
Vulnerability from github – Published: 2025-11-11 18:30 – Updated: 2025-11-11 18:30
VLAI
Details
Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-60720"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T18:15:40Z",
"severity": "HIGH"
},
"details": "Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-8fc7-45x6-26p6",
"modified": "2025-11-11T18:30:21Z",
"published": "2025-11-11T18:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60720"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60720"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8G89-49X9-PQR8
Vulnerability from github – Published: 2024-04-09 18:30 – Updated: 2024-04-09 18:30
VLAI
Details
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-28902"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-09T17:15:48Z",
"severity": "MODERATE"
},
"details": "Windows Remote Access Connection Manager Information Disclosure Vulnerability",
"id": "GHSA-8g89-49x9-pqr8",
"modified": "2024-04-09T18:30:26Z",
"published": "2024-04-09T18:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28902"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28902"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8HHV-RFXH-5V66
Vulnerability from github – Published: 2025-08-06 09:30 – Updated: 2025-08-06 09:30
VLAI
Details
Memory corruption while processing an IOCTL command with an arbitrary address.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-27068"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-06T08:15:29Z",
"severity": "HIGH"
},
"details": "Memory corruption while processing an IOCTL command with an arbitrary address.",
"id": "GHSA-8hhv-rfxh-5v66",
"modified": "2025-08-06T09:30:36Z",
"published": "2025-08-06T09:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27068"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8JJV-CW3Q-WM8P
Vulnerability from github – Published: 2026-07-14 18:32 – Updated: 2026-07-14 18:32
VLAI
Details
Buffer over-read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-50383"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T18:17:39Z",
"severity": "MODERATE"
},
"details": "Buffer over-read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.",
"id": "GHSA-8jjv-cw3q-wm8p",
"modified": "2026-07-14T18:32:19Z",
"published": "2026-07-14T18:32:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50383"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50383"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8MH6-R595-QC25
Vulnerability from github – Published: 2026-09-08 18:32 – Updated: 2026-09-08 18:32
VLAI
Details
Buffer over-read in Windows Win32K allows an authorized attacker to elevate privileges locally.
Severity
7.0 (High)
{
"affected": [],
"aliases": [
"CVE-2026-69610"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T18:19:32Z",
"severity": "HIGH"
},
"details": "Buffer over-read in Windows Win32K allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-8mh6-r595-qc25",
"modified": "2026-09-08T18:32:49Z",
"published": "2026-09-08T18:32:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69610"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69610"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8PW2-CHG7-6HCP
Vulnerability from github – Published: 2025-11-04 06:31 – Updated: 2025-11-04 06:31
VLAI
Details
Information disclosure while registering commands from clients with diag through diagHal.
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-27064"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-04T04:15:37Z",
"severity": "MODERATE"
},
"details": "Information disclosure while registering commands from clients with diag through diagHal.",
"id": "GHSA-8pw2-chg7-6hcp",
"modified": "2025-11-04T06:31:11Z",
"published": "2025-11-04T06:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27064"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8VJ8-FFQW-4WCQ
Vulnerability from github – Published: 2023-07-04 06:30 – Updated: 2024-04-04 05:22
VLAI
Details
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-28541"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-04T05:15:10Z",
"severity": "HIGH"
},
"details": "Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.",
"id": "GHSA-8vj8-ffqw-4wcq",
"modified": "2024-04-04T05:22:57Z",
"published": "2023-07-04T06:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28541"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WGX-9672-JJ5J
Vulnerability from github – Published: 2025-04-08 18:34 – Updated: 2025-04-08 18:34
VLAI
Details
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-26664"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T18:15:49Z",
"severity": "MODERATE"
},
"details": "Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.",
"id": "GHSA-8wgx-9672-jj5j",
"modified": "2025-04-08T18:34:46Z",
"published": "2025-04-08T18:34:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26664"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26664"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8WHP-GRC8-H7WP
Vulnerability from github – Published: 2026-04-14 18:30 – Updated: 2026-04-14 18:30
VLAI
Details
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-26155"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-14T18:16:47Z",
"severity": "MODERATE"
},
"details": "Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability",
"id": "GHSA-8whp-grc8-h7wp",
"modified": "2026-04-14T18:30:37Z",
"published": "2026-04-14T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26155"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26155"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8WPV-9RM8-HJ6H
Vulnerability from github – Published: 2026-06-09 18:30 – Updated: 2026-06-09 18:30
VLAI
Details
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Severity
4.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-45460"
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T17:17:20Z",
"severity": "MODERATE"
},
"details": "Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.",
"id": "GHSA-8wpv-9rm8-hj6h",
"modified": "2026-06-09T18:30:48Z",
"published": "2026-06-09T18:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45460"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45460"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.