CWE-125 Out-of-bounds Read

gomarkdown/markdown IsSafeURL panics on short URLs

Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information Disclosure Vulnerability

msgpack5: Truncated map32 headers throw an unexpected error

Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release

pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts

Astro: Remote code execution through AVIF image optimization

tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service

surfio has an out-of-bounds read

resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message

re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

ImageMagick: Information Disclosure when printing profiles with debug enabled

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read

nimiq-primitives: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries