Fallos del tipo CWE-125
6000 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2018-1179—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User iEPSS 2.4%CVE-2017-12992CRITICALThe RIPng parser in tcpdump before 4.9.2 has a buffer over-read in print-ripng.c:ripng_print().EPSS 2.4%CVE-2017-13015CRITICALThe EAP parser in tcpdump before 4.9.2 has a buffer over-read in print-eap.c:eap_print().EPSS 2.4%CVE-2017-13017CRITICALThe DHCPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-dhcp6.c:dhcp6opt_print().EPSS 2.4%CVE-2017-12895CRITICALThe ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().EPSS 2.4%CVE-2017-12996CRITICALThe PIMv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-pim.c:pimv2_print().EPSS 2.4%CVE-2017-12893CRITICALThe SMB/CIFS parser in tcpdump before 4.9.2 has a buffer over-read in smbutil.c:name_len().EPSS 2.4%CVE-2017-13001CRITICALThe NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:nfs_printfh().EPSS 2.4%CVE-2017-12901CRITICALThe EIGRP parser in tcpdump before 4.9.2 has a buffer over-read in print-eigrp.c:eigrp_print().EPSS 2.4%CVE-2023-21581MEDIUMAdobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.4%CVE-2024-20747MEDIUMTALOS-2023-1908 - Adobe Acrobat Reader Font CharStrings INDEX out-of-bounds read vulnerabilityEPSS 2.4%CVE-2021-31515HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID EPSS 2.4%CVE-2021-28612MEDIUMAdobe After Effects Out-of-bounds Read vulnerabilityEPSS 2.4%CVE-2021-28611MEDIUMAdobe After Effects Out-of-bounds Read vulnerabilityEPSS 2.4%CVE-2021-28614MEDIUMAdobe After Effects Out-of-bounds Read vulnerabilityEPSS 2.4%CVE-2021-28616MEDIUMAdobe After Effects Out-of-bounds Read vulnerabilityEPSS 2.4%CVE-2023-44348MEDIUMZDI-CAN-21925: (bypass of VULN-24891) Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.4%CVE-2023-44360MEDIUMZDI-CAN-21882: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.4%CVE-2022-24356HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader Foxit reader 11.0.1.0719 EPSS 2.3%CVE-2022-21722CRITICALPotential out-of-bound read during RTP/RTCP parsing in PJSIPEPSS 2.3%