Fallos del tipo CWE-125
5120 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2023-46045HIGHGraphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon becausEPSS 0.8%CVE-2024-26000MEDIUMPHOENIX CONTACT: Out of bounds read only memory accessEPSS 0.8%CVE-2023-51592MEDIUMBlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.8%CVE-2024-32301CRITICALTenda AC7V1.0 v15.03.06.44 firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function.EPSS 0.8%CVE-2024-30630CRITICALTenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the time parameter from saveParentControlInfo function.EPSS 0.8%CVE-2024-30587CRITICALTenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function.EPSS 0.8%CVE-2022-43610LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.EPSS 0.8%CVE-2024-43538MEDIUMWindows Mobile Broadband Driver Denial of Service VulnerabilityEPSS 0.8%CVE-2024-43537MEDIUMWindows Mobile Broadband Driver Denial of Service VulnerabilityEPSS 0.8%CVE-2024-43542MEDIUMWindows Mobile Broadband Driver Denial of Service VulnerabilityEPSS 0.8%CVE-2024-43540MEDIUMWindows Mobile Broadband Driver Denial of Service VulnerabilityEPSS 0.8%CVE-2026-43618MEDIUMRsync < 3.4.3 Integer Overflow Information DisclosureEPSS 0.8%CVE-2020-10597—Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processinEPSS 0.8%CVE-2025-27741HIGHNTFS Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-33599LOWOut-of-bounds read in service discoveryEPSS 0.8%CVE-2024-12055HIGHDoS using malicious gguf model file in ollama/ollamaEPSS 0.8%CVE-2023-47456CRITICALTenda AX1806 V1.0.0.1 contains a stack overflow vulnerability in function sub_455D4, called by function fromSetWirelessRepeat.EPSS 0.8%CVE-2022-20606MEDIUMIn SAEMM_MiningCodecTableWithMsgIE of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check. This EPSS 0.8%CVE-2025-58050MEDIUMPCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCSEPSS 0.8%CVE-2024-23264MEDIUMA validation issue was addressed with improved input sanitization. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS EPSS 0.8%