Weaknesses of type CWE-125
5,126 resultsLeitura fora dos limites de memória
Quando o código tenta ler dados além do tamanho alocado de um buffer, array ou estrutura de dados. O programa acessa memória que não deveria, podendo vazar informações sensíveis, causar travamento ou ser explorado para executar código arbitrário.
Example
Um validador de imagem PNG que lê o tamanho do chunk do header mas não verifica se esse tamanho é compatível com o arquivo; ao processar, lê bytes da memória adjacente, expondo dados de outras estruturas ou causando crash.
How to mitigate
Sempre validar comprimentos e índices antes de acessar buffers; usar funções seguras (strncpy em vez de strcpy, bounds checking em loops); compilar com sanitizadores (AddressSanitizer, Valgrind) para detectar em tempo de teste.
CVE-2022-22674MEDIUMAn out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issEPSS 1.1%KEVCVE-2020-5254LOWNetHack hilite_status parsing privilege escalationEPSS 1.1%CVE-2022-35261MEDIUMA denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted nEPSS 1.1%CVE-2020-5134—A vulnerability in SonicOS allows an authenticated attacker to cause out-of-bound invalid file reference leads to a firewall crash. This vulEPSS 1.1%CVE-2022-43596MEDIUMAn information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of OpenImageIO Project OpenImageIO v2.4.4EPSS 1.1%CVE-2022-43592MEDIUMAn information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A speciaEPSS 1.1%CVE-2024-44246MEDIUMThe issue was addressed with improved routing of Safari-originated requests. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iEPSS 1.1%CVE-2025-5456HIGHA buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA GatewaEPSS 1.1%CVE-2021-29463LOWOut-of-bounds read in Exiv2::WebPImage::doWriteMetadataEPSS 1.1%CVE-2022-34283—A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application is vulnerable to an out of bounds EPSS 1.1%CVE-2022-34288—A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application is vulnerable to an out of bounds EPSS 1.1%CVE-2022-34282—A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application is vulnerable to an out of bounds EPSS 1.1%CVE-2022-34285—A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application is vulnerable to an out of bounds EPSS 1.1%CVE-2022-0173CRITICALOut-of-bounds Read in radareorg/radare2EPSS 1.1%CVE-2021-0261HIGHJunos OS: Denial of Service vulnerability in J-Web and web based (HTTP/HTTPS) services caused by a high number of specific requestsEPSS 1.1%CVE-2023-39179HIGHKernel: ksmbd: read request out-of-bounds read information disclosure vulnerabilityEPSS 1.1%CVE-2026-56186HIGHWindows Secure Channel Information Disclosure VulnerabilityEPSS 1.1%CVE-2024-47542MEDIUMGHSL-2024-235: GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereferenceEPSS 1.1%CVE-2019-6547—Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior. An out-of-bounds read vulnerability may cause the softwEPSS 1.1%CVE-2024-49065MEDIUMMicrosoft Office Remote Code Execution VulnerabilityEPSS 1.1%