Fallos del tipo CWE-125
5159 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2023-26354MEDIUMZDI-CAN-19519: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-25863HIGHAdobe Substance 3D Stager USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.3%CVE-2023-26346MEDIUMZDI-CAN-19495: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-26790LOWWithsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Denial of Service via an out-of-bounds memory read during proceEPSS 0.3%CVE-2023-25873HIGHAdobe Substance 3D Stager SVG File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.3%CVE-2023-26356MEDIUMZDI-CAN-19506: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-49837MEDIUMGoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundariesEPSS 0.3%CVE-2023-26343MEDIUMZDI-CAN-19465: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-25869HIGHAdobe Substance 3D Stager SVG File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.3%CVE-2021-40425HIGHAn out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. A specially-crafted execEPSS 0.3%CVE-2026-25508MEDIUMESF-IDF Has Memory Safety Vulnerabilities in BLE ProvisioningEPSS 0.3%CVE-2023-26341MEDIUMZDI-CAN-19391: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%CVE-2022-42411LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interactiEPSS 0.3%CVE-2021-40424HIGHAn out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. A specially-crafted execEPSS 0.3%CVE-2023-26340MEDIUMZDI-CAN-19387: Adobe Dimension OBJ File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-26352MEDIUMZDI-CAN-19509: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%CVE-2022-42376LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interactiEPSS 0.3%CVE-2023-26355MEDIUMZDI-CAN-19512: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-86714MEDIUMPX4 Autopilot through 1.17.0 Stack Buffer Over-read via netmanEPSS 0.3%CVE-2023-26348MEDIUMZDI-CAN-19518: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.3%