Fallos del tipo CWE-125
5126 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2024-7522CRITICALEditor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, FireEPSS 0.6%CVE-2024-43508MEDIUMWindows Graphics Component Information Disclosure VulnerabilityEPSS 0.6%CVE-2021-44439—A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected prEPSS 0.6%CVE-2021-44450—A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK library in affected prEPSS 0.6%CVE-2026-87795HIGHzstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompressEPSS 0.6%CVE-2026-57075CRITICALYAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64decEPSS 0.6%CVE-2024-46670HIGHAn Out-of-bounds Read vulnerability [CWE-125] in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and below and FortiSASE FortiEPSS 0.6%CVE-2026-57074CRITICALXML::Bare versions through 0.53 for Perl have an unbounded character lookaheadEPSS 0.6%CVE-2026-9265CRITICALCrypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING pathEPSS 0.6%CVE-2022-41900HIGHFractionalMaxPool and FractionalAVGPool heap out-of-bounds acess in TensorflowEPSS 0.6%CVE-2023-37453MEDIUMAn issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in dEPSS 0.6%CVE-2024-38151MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.6%CVE-2024-25431HIGHAn issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privilegesEPSS 0.6%CVE-2024-11403MEDIUMOut of Bounds Memory Read/Write in libjxlEPSS 0.6%CVE-2025-29834HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-67857HIGHopen62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua_client_connect.c.EPSS 0.6%CVE-2026-85444HIGHMOOS-IvP through 24.8.1 Out-of-Bounds Read in isBraced, isQuoted and isChevronedEPSS 0.6%CVE-2023-27353MEDIUMThis vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-3EPSS 0.6%CVE-2026-27880HIGHOpenFeature evaluation API reads input data with no boundsEPSS 0.6%CVE-2026-46600HIGHParsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessageEPSS 0.6%