Fallos del tipo CWE-125
6000 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2017-16574—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User iEPSS 2.5%CVE-2017-14822—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User iEPSS 2.5%CVE-2017-10956—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User iEPSS 2.5%CVE-2017-10944—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User iEPSS 2.5%CVE-2017-14819—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User iEPSS 2.5%CVE-2017-16573—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User iEPSS 2.5%CVE-2017-14820—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User iEPSS 2.5%CVE-2017-16580—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User iEPSS 2.5%CVE-2021-35992LOWAdobe Bridge PostScript Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.5%CVE-2021-31239HIGHAn issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.EPSS 2.4%CVE-2024-39720HIGHAn issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytEPSS 2.4%CVE-2026-11645HIGHOut of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sanEPSS 2.4%KEVCVE-2021-28615MEDIUMAdobe After Effects Out-of-bounds Read vulnerability could lead to sensitive information disclosureEPSS 2.4%CVE-2021-28600MEDIUMAdobe After Effects Out-of-bounds Read vulnerability could lead to sensitive information disclosureEPSS 2.4%CVE-2021-36074LOWAdobe Bridge PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.4%CVE-2021-36071LOWAdobe Bridge PNG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.4%CVE-2022-28251MEDIUMAdobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.4%CVE-2019-10949—Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple out-of-bounds read vulnerabilities may be explEPSS 2.4%CVE-2017-12995CRITICALThe DNS parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-domain.c:ns_print().EPSS 2.4%CVE-2019-3728HIGHRSA BSAFE Crypto-C Micro Edition versions from 4.0.0.0 before 4.0.5.4 and from 4.1.0 before 4.1.4, RSA BSAFE Micro Edition Suite versions frEPSS 2.4%