Fallos del tipo CWE-125
5105 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2024-23529MEDIUMAn out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unaEPSS 1.9%CVE-2022-23204MEDIUMAdobe Premiere Rush JPEG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.9%CVE-2019-5065MEDIUMAn exploitable information disclosure vulnerability exists in the packet-parsing functionality of Blynk-Library v0.6.1. A specially crafted EPSS 1.9%CVE-2026-5946HIGHInvalid handling of CLASS != INEPSS 1.9%CVE-2021-21089LOWAdobe Acrobat Reader DC URI Parsing Out-Of-Bounds ReadEPSS 1.9%CVE-2021-32672MEDIUMVulnerability in Lua Debugger in RedisEPSS 1.9%CVE-2024-37371CRITICALIn MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message EPSS 1.9%CVE-2006-6016MEDIUMwp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified EPSS 1.9%CVE-2025-24230CRITICALAn out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, maEPSS 1.9%CVE-2020-11048LOWOut-of-bounds Read in FreeRDPrdp_read_flow_control_pduEPSS 1.8%CVE-2020-4030LOWOOB read in `TrioParse` in FreeRDPEPSS 1.8%CVE-2024-21343MEDIUMWindows Network Address Translation (NAT) Denial of Service VulnerabilityEPSS 1.8%CVE-2020-11096LOWGlobal OOB read in update_read_cache_bitmap_v3_order in FreeRDPEPSS 1.8%CVE-2020-4033LOWOOB Read in RLEDECOMPRESS in FreeRDPEPSS 1.8%CVE-2021-46623LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.8%CVE-2021-46628LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.8%CVE-2021-44187LOWAdobe Bridge SGI File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.8%CVE-2022-35260—curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no nEPSS 1.8%CVE-2021-34901LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.8%CVE-2021-44185LOWAdobe Bridge RGB File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.8%