Fallos del tipo CWE-125
6000 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2022-20473CRITICALIn toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote EPSS 8.9%CVE-2021-45060HIGHAdobe Acrobat Reader DC TTF Font Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 8.6%CVE-2020-8883LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916. UserEPSS 8.4%CVE-2020-8877LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916. UserEPSS 8.2%CVE-2019-17138LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.909. UserEPSS 8.2%CVE-2020-8879LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916. UserEPSS 8.2%CVE-2024-10387HIGHRockwell Automation FactoryTalk ThinManager Denial-of-Service VulnerabilityEPSS 8.0%CVE-2024-40777LOWAn out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.EPSS 7.7%CVE-2018-20679HIGHAn issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay)EPSS 7.7%CVE-2019-11050MEDIUMUse-after-free in exif parsing under memory sanitizerEPSS 7.6%CVE-2025-5419HIGHOut of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption EPSS 7.5%KEVCVE-2019-11047MEDIUMHeap-buffer-overflow READ in exifEPSS 7.5%CVE-2020-7059MEDIUMOOB read in php_strip_tags_exEPSS 7.4%CVE-2020-10898HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interacEPSS 6.8%CVE-2020-10895HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interacEPSS 6.8%CVE-2020-10902HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interacEPSS 6.8%CVE-2021-27247MEDIUMThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeChat 2.9.5 desktop versiEPSS 6.7%CVE-2022-20472CRITICALIn toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote EPSS 6.6%CVE-2024-30280HIGHZDI-CAN-22867: Adobe Acrobat Pro DC AcroForm Annotation Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 6.6%CVE-2019-15903MEDIUMIn libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutivEPSS 6.6%