Fallos del tipo CWE-125
5126 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2024-5159HIGHHeap buffer overflow in ANGLE in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory read via EPSS 0.6%CVE-2020-26998—A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected appliEPSS 0.6%CVE-2026-69679MEDIUMWindows DHCP Server Denial of Service VulnerabilityEPSS 0.6%CVE-2026-69637MEDIUMWindows DHCP Server Denial of Service VulnerabilityEPSS 0.6%CVE-2025-53014LOWImageMagick has Heap Buffer Overflow in InterpretImageFilenameEPSS 0.6%CVE-2026-25646HIGHLIBPNG has a heap buffer overflow in png_set_quantizeEPSS 0.6%CVE-2022-38403HIGHAdobe InCopy SVG File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-60727HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.6%CVE-2022-36052MEDIUMOut-of-bounds read when decompressing UDP headerEPSS 0.6%CVE-2024-52523MEDIUMNextcloud Server Custom defined credentials of external storages are sent back to the frontendEPSS 0.6%CVE-2023-30546CRITICALContiki-NG has off-by-one error in Antelope DBMSEPSS 0.6%CVE-2024-56378MEDIUMlibpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.EPSS 0.6%CVE-2024-26175HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2021-37203—A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8). The plmxmlAdapteEPSS 0.6%CVE-2025-11021HIGHLibsoup: out-of-bounds read in cookie date handling of libsoup http libraryEPSS 0.6%CVE-2023-42822MEDIUMUnchecked access to font glyph info in xrdpEPSS 0.6%CVE-2021-25487HIGHLack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it resEPSS 0.6%KEVCVE-2023-25738MEDIUMMembers of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid valuEPSS 0.6%CVE-2021-20024—Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability orEPSS 0.6%CVE-2025-66409LOWESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command HandlingEPSS 0.6%