Fallos del tipo CWE-125
6000 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2012-1571MEDIUMfile before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file tEPSS 4.1%CVE-2019-11046LOWBuffer underflow in bc_shift_addsubEPSS 4.1%CVE-2019-11034MEDIUMHeap over-read in PHP EXIF extensionEPSS 4.1%CVE-2018-17699—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.2.0.9297. User inEPSS 4.1%CVE-2019-6732—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF. User interactiEPSS 4.1%CVE-2020-7061MEDIUMheap-buffer-overflow in phar_extract_fileEPSS 4.1%CVE-2018-14465HIGHThe RSVP parser in tcpdump before 4.9.3 has a buffer over-read in print-rsvp.c:rsvp_obj_print().EPSS 4.1%CVE-2019-11040MEDIUMHeap buffer overflow in EXIF extensionEPSS 4.1%CVE-2021-28573MEDIUMAdobe Animate out-of-bounds read vulnerability could lead to information exposureEPSS 4.1%CVE-2020-8870HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interacEPSS 4.0%CVE-2018-14470HIGHThe Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().EPSS 4.0%CVE-2018-14467HIGHThe BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).EPSS 4.0%CVE-2018-14462HIGHThe ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().EPSS 4.0%CVE-2018-14461HIGHThe LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print().EPSS 4.0%CVE-2018-14468HIGHThe FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().EPSS 4.0%CVE-2018-9950—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User iEPSS 4.0%CVE-2020-15630LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. UserEPSS 4.0%CVE-2021-28565MEDIUMAdobe Acrobat Reader out-of-bounds read could lead to information exposureEPSS 3.9%CVE-2022-28330—read beyond bounds in mod_isapiEPSS 3.9%CVE-2018-17671—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.2.0.9297. User inEPSS 3.9%