Fallos del tipo CWE-125
5111 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2018-15378—Clam AntiVirus unmew11() Denial of Service VulnerabilityEPSS 1.3%CVE-2022-45315MEDIUMMikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows authentiEPSS 1.3%CVE-2021-44011—A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dllEPSS 1.3%CVE-2021-44015—A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The VCRUNTIME1EPSS 1.3%CVE-2021-44012—A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dllEPSS 1.3%CVE-2023-1532HIGHOut of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption viEPSS 1.3%CVE-2025-29836MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.3%CVE-2018-14798—Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. The proEPSS 1.3%CVE-2023-24872HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.3%CVE-2020-16211—Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by processing specially EPSS 1.3%CVE-2020-1671HIGHJunos OS: Receipt of malformed DHCPv6 packets causes jdhcpd to crash.EPSS 1.3%CVE-2022-36938CRITICALDexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index tEPSS 1.3%CVE-2023-40575MEDIUMOut-Of-Bounds Read in FreeRDPEPSS 1.3%CVE-2025-29835MEDIUMWindows Remote Access Connection Manager Information Disclosure VulnerabilityEPSS 1.3%CVE-2025-29832MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.3%CVE-2021-22757—A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of inEPSS 1.3%CVE-2021-22756—A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of inEPSS 1.3%CVE-2023-26489CRITICALGuest-controlled out-of-bounds read/write on x86_64 in wasmtimeEPSS 1.3%CVE-2023-42821HIGHgithub.com/gomarkdown/markdown Out-of-bounds Read while parsing citationsEPSS 1.3%CVE-2026-33096HIGHHTTP.sys Denial of Service VulnerabilityEPSS 1.2%