CWE-787
Out-of-bounds Write
Description
The product writes data past the end, or before the beginning, of the intended buffer.
Hierarchy (View 1000)
CVEs mapped to this weakness (15,178)
page 126 of 759| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-103415 | Cri | 0.60 | — | 0.00 | Oct 14, 2026 | When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before… | ||
| CVE-2026-103416 | Cri | 0.60 | — | 0.00 | Oct 7, 2026 | Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised… | ||
| CVE-2026-102761 | Cri | 0.60 | — | 0.00 | Sep 29, 2026 | NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two… | ||
| CVE-2026-13086 | Cri | 0.60 | — | 0.00 | Aug 28, 2026 | A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code. | ||
| CVE-2026-17422 | Cri | 0.60 | 9.3 | 0.00 | Aug 20, 2026 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow. | ||
| CVE-2026-0106 | Cri | 0.60 | 9.3 | 0.00 | Feb 5, 2026 | In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||
| CVE-2026-20407 | Cri | 0.60 | 9.3 | 0.00 | Feb 2, 2026 | In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00464377; Issue ID: MSV-4905. | ||
| CVE-2025-41238 | Cri | 0.60 | 9.3 | 0.00 | Jul 15, 2025 | VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as… | ||
| CVE-2025-41237 | Cri | 0.60 | 9.3 | 0.00 | Jul 15, 2025 | VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the… | ||
| CVE-2023-28578 | Cri | 0.60 | 9.3 | 0.00 | Mar 4, 2024 | Memory corruption in Core Services while executing the command for removing a single event listener. | ||
| CVE-2023-31030 | Cri | 0.60 | 9.3 | 0.01 | Jan 12, 2024 | NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service,… | ||
| CVE-2023-4280 | Cri | 0.60 | 9.3 | 0.00 | Jan 2, 2024 | An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region. | ||
| CVE-2023-33032 | Cri | 0.60 | 9.3 | 0.00 | Jan 2, 2024 | Memory corruption in TZ Secure OS while requesting a memory allocation from TA region. | ||
| CVE-2023-33030 | Cri | 0.60 | 9.3 | 0.00 | Jan 2, 2024 | Memory corruption in HLOS while running playready use-case. | ||
| CVE-2021-1942 | Cri | 0.60 | 9.3 | 0.00 | Apr 1, 2022 | Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables,… | ||
| CVE-2020-11210 | Cri | 0.60 | 9.3 | 0.00 | Apr 7, 2021 | Possible memory corruption in RPM region due to improper XPU configuration in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking | ||
| CVE-2020-27267 | Cri | 0.60 | 9.1 | 0.05 | Jan 14, 2021 | KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server… | ||
| CVE-2020-27263 | Cri | 0.60 | 9.1 | 0.05 | Jan 14, 2021 | KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server:… | ||
| CVE-2020-9906 | Cri | 0.60 | 9.1 | 0.05 | Oct 22, 2020 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, watchOS 6.2.8. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory. | ||
| CVE-2020-11901 | Cri | 0.60 | 9.0 | 0.21 | Jun 17, 2020 | The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response. |
- risk 0.60cvss —epss 0.00
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before…
- risk 0.60cvss —epss 0.00
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised…
- risk 0.60cvss —epss 0.00
NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two…
- risk 0.60cvss —epss 0.00
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
- risk 0.60cvss 9.3epss 0.00
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow.
- risk 0.60cvss 9.3epss 0.00
In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- risk 0.60cvss 9.3epss 0.00
In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00464377; Issue ID: MSV-4905.
- risk 0.60cvss 9.3epss 0.00
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as…
- risk 0.60cvss 9.3epss 0.00
VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the…
- risk 0.60cvss 9.3epss 0.00
Memory corruption in Core Services while executing the command for removing a single event listener.
- risk 0.60cvss 9.3epss 0.01
NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service,…
- risk 0.60cvss 9.3epss 0.00
An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region.
- risk 0.60cvss 9.3epss 0.00
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
- risk 0.60cvss 9.3epss 0.00
Memory corruption in HLOS while running playready use-case.
- risk 0.60cvss 9.3epss 0.00
Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables,…
- risk 0.60cvss 9.3epss 0.00
Possible memory corruption in RPM region due to improper XPU configuration in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
- risk 0.60cvss 9.1epss 0.05
KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server…
- risk 0.60cvss 9.1epss 0.05
KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server:…
- risk 0.60cvss 9.1epss 0.05
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, watchOS 6.2.8. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
- risk 0.60cvss 9.0epss 0.21
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.