Fallos del tipo CWE-125
5105 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2021-3998HIGHA flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage andEPSS 1.8%CVE-2022-28268LOWAdobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.8%CVE-2022-0400—An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.EPSS 1.8%CVE-2021-4156—An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (vEPSS 1.8%CVE-2021-4193MEDIUMOut-of-bounds Read in vim/vimEPSS 1.8%CVE-2019-14906HIGHA flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. This issue only affects Red HatEPSS 1.8%CVE-2021-22668—Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulnerable to an out-of-bEPSS 1.8%CVE-2020-27843—A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion oEPSS 1.8%CVE-2022-28830MEDIUMAdobe FrameMaker Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.7%CVE-2021-44182LOWAdobe Dimension SVG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.7%CVE-2021-43763LOWAdobe Dimension TIF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.7%CVE-2025-22226HIGHVMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actorEPSS 1.7%KEVCVE-2023-36905MEDIUMWindows Wireless Wide Area Network Service (WwanSvc) Information Disclosure VulnerabilityEPSS 1.7%CVE-2022-0128HIGHOut-of-bounds Read in vim/vimEPSS 1.7%CVE-2020-27336LOWAn issue was discovered in Treck IPv6 before 6.0.1.68. Improper input validation in the IPv6 component when handling a packet sent by an unaEPSS 1.7%CVE-2020-5235MEDIUMOut-of-memory condition in Nanopb is potentially exploitableEPSS 1.7%CVE-2022-2127MEDIUMSamba: out-of-bounds read in winbind auth_crapEPSS 1.7%CVE-2025-5318MEDIUMLibssh: out-of-bounds read in sftp_handle()EPSS 1.7%CVE-2020-11047MEDIUMOut-of-bounds Read in FreeRDPEPSS 1.7%CVE-2021-46607LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16EPSS 1.7%