CVE-2026-96860
Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.
CVSS
5.5
Medio
EPSS
0.4%
p32
KEV
—
Exploit Today
10
0-100
Publicado: 13 oct 2026 · Última mod.: 13 oct 2026 · CWE-125 · CWE-170
0.4%EPSS · 30 días0.4%
2026-10-142026-10-15
Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1113765.0 MED—
———FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SIZE request with a cbRequested of fewer than eight bytes when a user pastes a remote file, crashing the client or corrupting the stream size.7hCVE-2026-1113754.8 MED—
———FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWindowTextW, corrupting titles or crashing the client.7hCVE-2026-105228——
———This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.7hCVE-2026-105227——
———This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.7hCVE-2026-1112745.5 MED—
———unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.12hCVE-2026-1112725.5 MED—
———LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.12h