Weaknesses of type CWE-125
5,159 resultsLeitura fora dos limites de memória
Quando o código tenta ler dados além do tamanho alocado de um buffer, array ou estrutura de dados. O programa acessa memória que não deveria, podendo vazar informações sensíveis, causar travamento ou ser explorado para executar código arbitrário.
Example
Um validador de imagem PNG que lê o tamanho do chunk do header mas não verifica se esse tamanho é compatível com o arquivo; ao processar, lê bytes da memória adjacente, expondo dados de outras estruturas ou causando crash.
How to mitigate
Sempre validar comprimentos e índices antes de acessar buffers; usar funções seguras (strncpy em vez de strcpy, bounds checking em loops); compilar com sanitizadores (AddressSanitizer, Valgrind) para detectar em tempo de teste.
CVE-2024-7522CRITICALEditor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, FireEPSS 0.6%CVE-2021-44439—A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected prEPSS 0.6%CVE-2021-44450—A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK library in affected prEPSS 0.6%CVE-2026-87795HIGHzstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompressEPSS 0.6%CVE-2026-57074CRITICALXML::Bare versions through 0.53 for Perl have an unbounded character lookaheadEPSS 0.6%CVE-2026-9265CRITICALCrypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING pathEPSS 0.6%CVE-2026-57075CRITICALYAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64decEPSS 0.6%CVE-2024-46670HIGHAn Out-of-bounds Read vulnerability [CWE-125] in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and below and FortiSASE FortiEPSS 0.6%CVE-2022-41900HIGHFractionalMaxPool and FractionalAVGPool heap out-of-bounds acess in TensorflowEPSS 0.6%CVE-2024-38151MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.6%CVE-2025-48002MEDIUMWindows Hyper-V Information Disclosure VulnerabilityEPSS 0.6%CVE-2024-25431HIGHAn issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privilegesEPSS 0.6%CVE-2023-37453MEDIUMAn issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in dEPSS 0.6%CVE-2024-11403MEDIUMOut of Bounds Memory Read/Write in libjxlEPSS 0.6%CVE-2025-29834HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-67857HIGHopen62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua_client_connect.c.EPSS 0.6%CVE-2026-85444HIGHMOOS-IvP through 24.8.1 Out-of-Bounds Read in isBraced, isQuoted and isChevronedEPSS 0.6%CVE-2023-27353MEDIUMThis vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-3EPSS 0.6%CVE-2026-27880HIGHOpenFeature evaluation API reads input data with no boundsEPSS 0.6%CVE-2026-46600HIGHParsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessageEPSS 0.6%