Weaknesses of type CWE-125
5,126 resultsLeitura fora dos limites de memória
Quando o código tenta ler dados além do tamanho alocado de um buffer, array ou estrutura de dados. O programa acessa memória que não deveria, podendo vazar informações sensíveis, causar travamento ou ser explorado para executar código arbitrário.
Example
Um validador de imagem PNG que lê o tamanho do chunk do header mas não verifica se esse tamanho é compatível com o arquivo; ao processar, lê bytes da memória adjacente, expondo dados de outras estruturas ou causando crash.
How to mitigate
Sempre validar comprimentos e índices antes de acessar buffers; usar funções seguras (strncpy em vez de strcpy, bounds checking em loops); compilar com sanitizadores (AddressSanitizer, Valgrind) para detectar em tempo de teste.
CVE-2024-26174MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.9%CVE-2021-44008—A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_LoadeEPSS 0.9%CVE-2020-15211MEDIUMOut of bounds access in tensorflow-liteEPSS 0.9%CVE-2021-33648—When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shapEPSS 0.9%CVE-2021-33650—When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less than three, it will access dataEPSS 0.9%CVE-2021-33649—When performing the inference shape operation of the Transpose operator, if the value in the perm element is greater than or equal to the siEPSS 0.9%CVE-2023-46569CRITICALAn out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h.EPSS 0.9%CVE-2023-26253HIGHIn Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read.EPSS 0.9%CVE-2026-80096HIGHWindows Remote Desktop Services Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2022-35263MEDIUMA denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted nEPSS 0.9%CVE-2022-24383HIGHICSA-22-090-03 Fuji Electric Alpha5EPSS 0.9%CVE-2022-35262MEDIUMA denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted nEPSS 0.9%CVE-2024-34200HIGHTOTOLINK CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpQosRules function.EPSS 0.9%CVE-2024-4059MEDIUMOut of bounds read in V8 API in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to leak cross-site data via a crafted HTML paEPSS 0.9%CVE-2020-15265MEDIUMSegfault in TensorflowEPSS 0.9%CVE-2021-3548—A flaw was found in dmg2img through 20170502. dmg2img did not validate the size of the read buffer during memcpy() inside the main() functioEPSS 0.9%CVE-2021-32614—A flaw was found in dmg2img through 20170502. fill_mishblk() does not check the length of the read buffer, and copy 0xCC bytes from it. The EPSS 0.9%CVE-2026-8186MEDIUMOpen5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out-of-boundsEPSS 0.9%CVE-2020-15208HIGHData corruption in tensorflow-liteEPSS 0.9%CVE-2023-33537HIGHTP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/FixMapEPSS 0.9%