Fallos del tipo CWE-125
5099 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2017-12899CRITICALThe DECnet parser in tcpdump before 4.9.2 has a buffer over-read in print-decnet.c:decnet_print().EPSS 3.3%CVE-2021-28618MEDIUMAdobe Animate out-of-bounds read vulnerability could lead to sensitive information disclosureEPSS 3.3%CVE-2019-8242MEDIUMAdobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information diEPSS 3.3%CVE-2019-8243MEDIUMAdobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information diEPSS 3.3%CVE-2019-8244MEDIUMAdobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information diEPSS 3.3%CVE-2019-8241MEDIUMAdobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information diEPSS 3.3%CVE-2017-7544—libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c cEPSS 3.3%CVE-2025-14766HIGHOut of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruptionEPSS 3.2%CVE-2017-13055CRITICALThe ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_is_reach_subtlv().EPSS 3.2%CVE-2017-13048CRITICALThe RSVP parser in tcpdump before 4.9.2 has a buffer over-read in print-rsvp.c:rsvp_obj_print().EPSS 3.2%CVE-2017-13034CRITICALThe PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print().EPSS 3.2%CVE-2017-13688CRITICALThe OLSR parser in tcpdump before 4.9.2 has a buffer over-read in print-olsr.c:olsr_print().EPSS 3.2%CVE-2017-13053CRITICALThe BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:decode_rt_routing_info().EPSS 3.2%CVE-2017-13689CRITICALThe IKEv1 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:ikev1_id_print().EPSS 3.2%CVE-2017-13031CRITICALThe IPv6 fragmentation header parser in tcpdump before 4.9.2 has a buffer over-read in print-frag6.c:frag6_print().EPSS 3.2%CVE-2017-13047CRITICALThe ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print().EPSS 3.2%CVE-2017-13054CRITICALThe LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_private_8023_print().EPSS 3.2%CVE-2017-13027CRITICALThe LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_mgmt_addr_tlv_print().EPSS 3.2%CVE-2022-28241HIGHAdobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 3.2%CVE-2021-28619MEDIUMAdobe Animate out-of-bounds read vulnerability could lead to sensitive information disclosureEPSS 3.2%