Fallos del tipo CWE-125
5148 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2023-25906HIGHZDI-CAN-20046: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-25907HIGHZDI-CAN-20216: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-11809LOWUpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadataEPSS 0.4%CVE-2023-26333HIGHZDI-CAN-20214: Adobe Dimension USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-25891HIGHZDI-CAN-19542: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-32460MEDIUMGraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.EPSS 0.4%CVE-2023-47048MEDIUMZDI-CAN-21688: Adobe Audition MP4 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-49687HIGHWindows Input Method Editor (IME) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2023-3523MEDIUMOut-of-bounds Read in gpac/gpacEPSS 0.4%CVE-2023-47050MEDIUMZDI-CAN-21686: Adobe Audition M4A File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-47049MEDIUMZDI-CAN-21690: Adobe Audition MP4 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-43789MEDIUMLibxpm: out of bounds read on xpm with corrupted colormapEPSS 0.4%CVE-2023-44114—Out-of-bounds array vulnerability in the dataipa module.Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.4%CVE-2025-54169MEDIUMFile Station 5EPSS 0.4%CVE-2025-54070MEDIUMOpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffersEPSS 0.4%CVE-2025-1673HIGHOut of bounds read when calling crc16_ansi and strlen in dns_validate_msgEPSS 0.4%CVE-2026-21899MEDIUMCryptoLib has an out-of-bounds read and crash vulnerability when decoding an empty Base64url stringEPSS 0.4%CVE-2022-35669MEDIUMAdobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%CVE-2021-34950HIGHFoxit PDF Reader Annotation Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.3%CVE-2022-34252MEDIUMAdobe InCopy Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%