Fallos del tipo CWE-125
5119 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2025-21229MEDIUMWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-21255MEDIUMWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-21232MEDIUMWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-21227MEDIUMWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-21258MEDIUMWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-69803MEDIUMWindows DHCP Server Information Disclosure VulnerabilityEPSS 0.8%CVE-2024-47774MEDIUMGHSL-2024-262: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunkEPSS 0.8%CVE-2020-6976—Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. An out-of-bounds read overflow can be exploited when a valid user openEPSS 0.8%CVE-2020-10637—Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues. A EPSS 0.8%CVE-2024-22040HIGHA vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions),EPSS 0.8%CVE-2020-7853MEDIUMTOBESOFT XPLATFORM Out-of-Bounds Read/Write VulnerabilitiesEPSS 0.8%CVE-2022-43611LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.EPSS 0.8%CVE-2018-19020—When CX-Supervisor (Versions 3.42 and prior) processes project files and tampers with the value of an offset, an attacker can force the applEPSS 0.8%CVE-2022-43612LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.EPSS 0.8%CVE-2022-43615LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.EPSS 0.8%CVE-2026-42914MEDIUMWindows Kerberos Denial of Service VulnerabilityEPSS 0.8%CVE-2022-21726HIGHOut of bounds read in TensorflowEPSS 0.8%CVE-2026-39979MEDIUMjq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted BuffersEPSS 0.8%CVE-2023-33139MEDIUMVisual Studio Information Disclosure VulnerabilityEPSS 0.8%CVE-2023-51589MEDIUMBlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.8%