Fallos del tipo CWE-125
5179 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2022-33253HIGHBuffer over-read in WLANEPSS 0.2%CVE-2026-40917MEDIUMGimp: gimp: application crashes or information disclosure via crafted icns image filesEPSS 0.2%CVE-2025-47755HIGHV-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!VS4_SaveEnvFile function. Opening specially crafted V7 oEPSS 0.2%CVE-2022-2380MEDIUMThe Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerabiEPSS 0.2%CVE-2026-9539MEDIUMlibslirp TCP URG OOB Read Information LeakEPSS 0.2%CVE-2023-29933MEDIUMllvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument.EPSS 0.2%CVE-2025-53048MEDIUMVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Rich Text Editor). Supported versions that EPSS 0.2%CVE-2023-29942MEDIUMllvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa<mlir::LLVM::LLVMVoidType.EPSS 0.2%CVE-2023-29934MEDIUMllvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect().EPSS 0.2%CVE-2025-11413MEDIUMGNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-boundsEPSS 0.2%CVE-2025-7322HIGHIrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-61833HIGHSubstance3D - Stager | Out-of-bounds Read (CWE-125)EPSS 0.2%CVE-2026-18416LOWOut-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)EPSS 0.2%CVE-2025-53063MEDIUMVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions thEPSS 0.2%CVE-2023-44084HIGHA vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (AllEPSS 0.2%CVE-2024-39277HIGHdma-mapping: benchmark: handle NUMA_NO_NODE correctlyEPSS 0.2%CVE-2025-7279HIGHIrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-7268HIGHIrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-7267HIGHIrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-40339MEDIUMlibgphoto2 has OOB read in ptp_unpack_Sony_DPD() FormFlag parsing in ptp-pack.cEPSS 0.2%