Fallos del tipo CWE-125
6000 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2022-34226HIGHAdobe Acrobat Reader DC PDF Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 5.0%CVE-2019-13331HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interactionEPSS 5.0%CVE-2020-24409HIGHAdobe Illustrator PDF File Parsing Out-Of-Bounds Read VulnerabilityEPSS 4.9%CVE-2020-24410HIGHAdobe Illustrator PDF File Parsing Out-Of-Bounds Read VulnerabilityEPSS 4.9%CVE-2020-10901LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. UserEPSS 4.9%CVE-2018-17895—LAquis SCADA Versions 4.1.0.3870 and prior has several out-of-bounds read vulnerabilities, which may allow remote code execution.EPSS 4.8%CVE-2016-8621MEDIUMThe `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit shorEPSS 4.8%CVE-2020-10905LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. UserEPSS 4.8%CVE-2020-10903LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. UserEPSS 4.8%CVE-2018-14881CRITICALThe BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).EPSS 4.8%CVE-2020-10894LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. UserEPSS 4.7%CVE-2019-5747HIGHAn issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or reEPSS 4.7%CVE-2019-6728—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction iEPSS 4.6%CVE-2017-13050CRITICALThe RPKI-Router parser in tcpdump before 4.9.2 has a buffer over-read in print-rpki-rtr.c:rpki_rtr_pdu_print().EPSS 4.6%CVE-2017-9049HIGHlibxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulEPSS 4.6%CVE-2017-13041CRITICALThe ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().EPSS 4.6%CVE-2017-13040CRITICALThe MPTCP parser in tcpdump before 4.9.2 has a buffer over-read in print-mptcp.c, several functions.EPSS 4.6%CVE-2020-9750HIGHOut-of-bounds read vulnerability in Adobe Animate 20.5EPSS 4.5%CVE-2017-13038CRITICALThe PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp().EPSS 4.5%CVE-2017-13019CRITICALThe PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print().EPSS 4.5%