CVE-2026-46199
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Check bounds a
CVSS
7.1
Alto
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Publicado: 28 may 2026 · Última mod.: 19 oct 2026 · CWE-125
0.1%EPSS · 30 días0.1%
2026-09-282026-10-25
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg.
- git.kernel.orghttps://git.kernel.org/stable/c/0a78f2bac1424deb7c9d5e09c6b8e849d8e8b648
- git.kernel.orghttps://git.kernel.org/stable/c/3c817a60b09eaab926e475088e750936efcc95ae
- git.kernel.orghttps://git.kernel.org/stable/c/63b51e8a9d54317d31cc3856c1e12407070d5fc2
- git.kernel.orghttps://git.kernel.org/stable/c/7688143ca62edeecacb3ba0a2cea129dbd262a18
- git.kernel.orghttps://git.kernel.org/stable/c/88411caee8f576d6b5abf6531232fcc0ce756dc5
- git.kernel.orghttps://git.kernel.org/stable/c/c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1168415.5 MED—
———DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.7hCVE-2026-1166207.3 ALT—
———A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.7hCVE-2025-714395.5 MED—
———llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past id_to_token and crash.7hCVE-2024-583996.1 MED—
———llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the process or load adjacent process memory as model weights.7hCVE-2026-1167445.3 MED—
———ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer.10hCVE-2026-1167366.1 MED—
———Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.10h