Fallos del tipo CWE-125
6000 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2024-38214MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.6%CVE-2021-29458—Out-of-bounds read in Exiv2::Internal::CrwMap::encodeEPSS 1.6%CVE-2026-25181HIGHGDI+ Information Disclosure VulnerabilityEPSS 1.6%CVE-2025-32715MEDIUMRemote Desktop Protocol Client Information Disclosure VulnerabilityEPSS 1.6%CVE-2019-1853MEDIUMCisco AnyConnect Secure Mobility Client for Linux Out-of-Bounds Memory Read VulnerabilityEPSS 1.6%CVE-2024-48208HIGHpure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.EPSS 1.6%CVE-2022-2126HIGHOut-of-bounds Read in vim/vimEPSS 1.6%CVE-2025-49796CRITICALLibxml: type confusion leads to denial of service (dos)EPSS 1.6%CVE-2020-11040LOWOut-of-bounds Read in FreeRDPEPSS 1.5%CVE-2022-47940HIGHAn issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the nonEPSS 1.5%CVE-2022-41649HIGHA heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0. A specially-EPSS 1.5%CVE-2020-12403—A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could causeEPSS 1.5%CVE-2024-28515CRITICALBuffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of csEPSS 1.5%CVE-2022-24055LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. UEPSS 1.5%CVE-2022-24060LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. UEPSS 1.5%CVE-2024-37401HIGHAn out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial oEPSS 1.5%CVE-2025-29960MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.5%CVE-2021-20266—A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds reaEPSS 1.5%CVE-2020-12018—Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorizeEPSS 1.5%CVE-2021-36001LOWAdobe Character Animator PNG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.5%