Fallos del tipo CWE-125
5105 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2021-46600LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16EPSS 1.6%CVE-2021-34943LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.6%CVE-2021-34944LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.6%CVE-2023-24924HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.6%CVE-2022-0623MEDIUMOut-of-bounds Read in mruby/mrubyEPSS 1.6%CVE-2019-10129MEDIUMA vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can EPSS 1.6%CVE-2023-32034MEDIUMRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.6%CVE-2023-32035MEDIUMRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.6%CVE-2023-33164MEDIUMRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.6%CVE-2023-35318MEDIUMRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.6%CVE-2023-35319MEDIUMRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.6%CVE-2023-35314MEDIUMRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.6%CVE-2022-1851HIGHOut-of-bounds Read in vim/vimEPSS 1.6%CVE-2022-33319HIGHOut-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GEPSS 1.6%CVE-2024-37338HIGHMicrosoft SQL Server Native Scoring Remote Code Execution VulnerabilityEPSS 1.6%CVE-2021-46611LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16EPSS 1.6%CVE-2021-20254—A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that perEPSS 1.6%CVE-2017-2579LOWAn out-of-bounds read vulnerability was found in netpbm before 10.61. The expandCodeOntoStack() function has an insufficient code value checEPSS 1.6%CVE-2024-3159HIGHOut of bounds memory access in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to perform arbitrary read/write via a cEPSS 1.6%CVE-2021-46630LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.6%