Skip to content
CVE Tracker

CWE-125: Out-of-bounds read

10,593 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 19 of them as exploited in the wild.

All 10,593 in the listAtom feed of new CVEsWhat CWE-125 is, at MITRE (opens in a new tab)
Published CVEs
10,593
Last 12 months
2,684
Critical
762
Known exploited
19

Critical 762High 4,217Medium 4,867Low 736Not scored 11

CVEs per yearBy the year they were published

  1. 2018844
  2. 2019819
  3. 201933
  4. 202230
  5. 2024200
  6. 20251,012
  7. 2025895
  8. 2025824
  9. 2025803
  10. 20262,443
  11. 2026920
  12. 2026998

Known exploitedNewest addition to KEV first

  • CVE-2026-11645

    Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2023-36424

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Microsoft · Windows 11 version 22H3

    ExploitedHigh7.8
  • CVE-2026-3055

    Insufficient input validation leading to memory overread

    NetScaler · ADC

    ExploitedCritical9.3
  • CVE-2025-5777

    NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

    NetScaler · ADC

    ExploitedCritical9.3
  • CVE-2025-5419

    Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2024-53150

    ALSA: usb-audio: Fix out of bounds reads when finding clock sources

    Linux · Linux

    ExploitedHigh7.1
  • CVE-2025-24991

    Windows NTFS Information Disclosure Vulnerability

    Microsoft · Windows 10 Version 1507

    ExploitedMedium5.5
  • CVE-2025-22226

    VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with…

    ESXi

    ExploitedHigh7.1
  • CVE-2024-0519

    Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2023-42916

    An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2.…

    Apple · Safari

    ExploitedMedium6.5

Newest CVEs

  • CVE-2026-121093

    Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted…

    Google · Chrome

    Not scored
  • CVE-2026-121049

    Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity:…

    Google · Chrome

    Not scored
  • CVE-2026-121184

    Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a…

    Google · Chrome

    High8.8
  • CVE-2026-121208

    Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a…

    Google · Chrome

    High8.8
  • CVE-2026-121160

    Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page.…

    Google · Chrome

    Not scored
  • CVE-2026-121084

    Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code…

    Google · Chrome

    High8.3
  • CVE-2026-121032

    Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page.…

    Google · Chrome

    Not scored
  • CVE-2026-121140

    Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially…

    Google · Chrome

    High8.3
  • CVE-2026-121112

    Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially…

    Google · Chrome

    High8.3
  • CVE-2026-121197

    Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML…

    Google · Chrome

    Not scored

Vendors it comes up for most

  1. Adobe882
  2. Microsoft809
  3. Linux688
  4. Google446
  5. Apple392
  6. Qualcomm, Inc.362
  7. Siemens181
  8. Foxit176
  9. PDF-XChange151
  10. MediaTek, Inc.150