Weaknesses of type CWE-125
5,140 resultsLeitura fora dos limites de memória
Quando o código tenta ler dados além do tamanho alocado de um buffer, array ou estrutura de dados. O programa acessa memória que não deveria, podendo vazar informações sensíveis, causar travamento ou ser explorado para executar código arbitrário.
Example
Um validador de imagem PNG que lê o tamanho do chunk do header mas não verifica se esse tamanho é compatível com o arquivo; ao processar, lê bytes da memória adjacente, expondo dados de outras estruturas ou causando crash.
How to mitigate
Sempre validar comprimentos e índices antes de acessar buffers; usar funções seguras (strncpy em vez de strcpy, bounds checking em loops); compilar com sanitizadores (AddressSanitizer, Valgrind) para detectar em tempo de teste.
CVE-2024-20941MEDIUMVulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: HTML UI). Supported versions that are affected arEPSS 0.4%CVE-2022-43359HIGHGifdec commit 1dcbae19363597314f6623010cc80abad4e47f7c was discovered to contain an out-of-bounds read in the function read_image_data. ThisEPSS 0.4%CVE-2025-65092MEDIUMESP32-P4 JPEG Decoder Header Parsing VulnerabilityEPSS 0.4%CVE-2023-1916—A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read EPSS 0.4%CVE-2025-11211HIGHOut of bounds read in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory acEPSS 0.4%CVE-2023-38253MEDIUMW3m: out of bounds read in growbuf_to_str() at w3m/indep.cEPSS 0.4%CVE-2024-20949MEDIUMVulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versionsEPSS 0.4%CVE-2023-38252MEDIUMW3m: out of bounds read in strnew_size() at w3m/str.cEPSS 0.4%CVE-2022-42379HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reEPSS 0.4%CVE-2026-21485HIGHiccDEV Undefined Behavior (UB) and Out of Memory in CIccProfile::LoadTag()EPSS 0.4%CVE-2022-41146LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interactiEPSS 0.4%CVE-2022-41145LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interactiEPSS 0.4%CVE-2024-8843LOWPDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-48029HIGHlibheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflowEPSS 0.4%CVE-2024-24459MEDIUMAn invalid memory access when handling the ProtocolIE_ID field of S1Setup Request messages in Athonet vEPC MME v11.4.0 allows attackers to cEPSS 0.4%CVE-2024-24455MEDIUMAn invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows aEPSS 0.4%CVE-2026-87736MEDIUMAn issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed EPSS 0.4%CVE-2024-24458MEDIUMAn invalid memory access when handling the ENB Configuration Transfer messages containing invalid PLMN Identities in Athonet vEPC MME v11.4.EPSS 0.4%CVE-2024-24454MEDIUMAn invalid memory access when handling the ProtocolIE_ID field of E-RAB Modify Request messages in Athonet vEPC MME v11.4.0 allows attackersEPSS 0.4%CVE-2024-24453MEDIUMAn invalid memory access when handling the ProtocolIE_ID field of E-RAB NotToBeModifiedBearerModInd information element in Athonet vEPC MME EPSS 0.4%