Fallos del tipo CWE-125
5094 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2020-10895HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interacEPSS 4.9%CVE-2020-10902HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interacEPSS 4.9%CVE-2020-10898HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interacEPSS 4.9%CVE-2020-24409HIGHAdobe Illustrator PDF File Parsing Out-Of-Bounds Read VulnerabilityEPSS 4.9%CVE-2020-24410HIGHAdobe Illustrator PDF File Parsing Out-Of-Bounds Read VulnerabilityEPSS 4.9%CVE-2018-17895—LAquis SCADA Versions 4.1.0.3870 and prior has several out-of-bounds read vulnerabilities, which may allow remote code execution.EPSS 4.8%CVE-2018-14881CRITICALThe BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).EPSS 4.8%CVE-2019-5747HIGHAn issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or reEPSS 4.7%CVE-2019-6728—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction iEPSS 4.6%CVE-2017-13050CRITICALThe RPKI-Router parser in tcpdump before 4.9.2 has a buffer over-read in print-rpki-rtr.c:rpki_rtr_pdu_print().EPSS 4.6%CVE-2017-9049HIGHlibxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulEPSS 4.6%CVE-2017-13040CRITICALThe MPTCP parser in tcpdump before 4.9.2 has a buffer over-read in print-mptcp.c, several functions.EPSS 4.6%CVE-2017-13041CRITICALThe ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().EPSS 4.6%CVE-2020-9750HIGHOut-of-bounds read vulnerability in Adobe Animate 20.5EPSS 4.5%CVE-2017-13019CRITICALThe PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print().EPSS 4.5%CVE-2017-13038CRITICALThe PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp().EPSS 4.5%CVE-2024-20653HIGHMicrosoft Common Log File System Elevation of Privilege VulnerabilityEPSS 4.5%CVE-2022-21723CRITICALOut-of-bounds read in multipart parsing in PJSIPEPSS 4.5%CVE-2020-9675HIGHAdobe Bridge versions 10.0.3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execEPSS 4.4%CVE-2019-11042MEDIUMheap-buffer-overflow on exif_process_user_comment in EXIF extensionEPSS 4.4%