Weaknesses of type CWE-125
5,104 resultsLeitura fora dos limites de memória
Quando o código tenta ler dados além do tamanho alocado de um buffer, array ou estrutura de dados. O programa acessa memória que não deveria, podendo vazar informações sensíveis, causar travamento ou ser explorado para executar código arbitrário.
Example
Um validador de imagem PNG que lê o tamanho do chunk do header mas não verifica se esse tamanho é compatível com o arquivo; ao processar, lê bytes da memória adjacente, expondo dados de outras estruturas ou causando crash.
How to mitigate
Sempre validar comprimentos e índices antes de acessar buffers; usar funções seguras (strncpy em vez de strcpy, bounds checking em loops); compilar com sanitizadores (AddressSanitizer, Valgrind) para detectar em tempo de teste.
CVE-2010-4577HIGHThe CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS befoEPSS 2.2%CVE-2024-37966HIGHMicrosoft SQL Server Native Scoring Information Disclosure VulnerabilityEPSS 2.2%CVE-2022-28254MEDIUMAdobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.2%CVE-2022-28255MEDIUMAdobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.2%CVE-2022-28257MEDIUMAdobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.2%CVE-2022-28245MEDIUMAdobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.2%CVE-2022-28253MEDIUMAdobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.2%CVE-2021-43804HIGHOut-of-bounds read when parsing RTCP BYE message in PJSIPEPSS 2.2%CVE-2026-11645HIGHOut of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sanEPSS 2.2%KEVCVE-2021-27264LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. UseEPSS 2.2%CVE-2021-27266LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. UseEPSS 2.2%CVE-2021-43302—Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds reEPSS 2.2%CVE-2018-3745—atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.EPSS 2.2%CVE-2021-39865LOWAdobe FrameMaker TIF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.2%CVE-2022-38449MEDIUMAdobe Acrobat Reader DC JP2 File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.2%CVE-2021-42719HIGHAdobe Bridge Out-of-bounds read could lead to Arbitrary Code ExecutionEPSS 2.2%CVE-2021-31239HIGHAn issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.EPSS 2.2%CVE-2021-22643—Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1EPSS 2.2%CVE-2021-31471LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User inEPSS 2.1%CVE-2022-31001HIGHOut-of-bounds Read in Sofia-SIPEPSS 2.1%