Fallos del tipo CWE-125
5143 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2023-26329HIGHZDI-CAN-20213: Adobe Dimension OBJ File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-93682MEDIUMOut-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location headerEPSS 0.4%CVE-2025-66589HIGHOut-of-bounds Read vulnerability in AzeoTech DAQFactoryEPSS 0.4%CVE-2025-66293HIGHLIBPNG has an out-of-bounds read in png_image_read_compositeEPSS 0.4%CVE-2023-25884HIGHZDI-CAN-19411: Adobe Dimension GLTF File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-25889HIGHZDI-CAN-19466: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-73863HIGHNanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE ParsingEPSS 0.4%CVE-2023-26333HIGHZDI-CAN-20214: Adobe Dimension USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-25904HIGHAdobe Dimension Out-of-bounds Read USDZ file Arbitrary code executionEPSS 0.4%CVE-2023-25892HIGHZDI-CAN-19523: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-32460MEDIUMGraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.EPSS 0.4%CVE-2022-34889HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 17.1.1 (51537). An attacker EPSS 0.4%CVE-2023-25891HIGHZDI-CAN-19542: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-25907HIGHZDI-CAN-20216: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-25902HIGHZDI-CAN-19560: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-25886HIGHZDI-CAN-19452: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-23672HIGHWindows Universal Disk Format File System Driver (UDFS) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2023-26335HIGHZDI-CAN-20215: Adobe Dimension USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-11809LOWUpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadataEPSS 0.4%CVE-2023-25887HIGHZDI-CAN-19450: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%