Fallos del tipo CWE-125
5126 resultadosLeitura fora dos limites do buffer
Ocorre quando o código tenta acessar dados além das fronteiras válidas de um buffer (array, string, estrutura), lendo memória que não deveria. O risco é expor informações sensíveis da memória adjacente ou causar crash da aplicação.
Ejemplo
Uma função que processa strings sem validar o tamanho da entrada pode ler bytes além do final da string alocada, vazando dados de memória ou causando segmentation fault. Exemplo: strcpy() copiando para buffer menor sem checagem.
Cómo mitigar
Use funções seguras com limite explícito (strlen com buffer_size, strncpy, snprintf), valide índices antes de acessar arrays, e ative verificações de limite em tempo de compilação ou execução (-ftrapv, ASAN, bounds checking).
CVE-2026-37461HIGHAn out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) viaEPSS 0.6%CVE-2026-76641HIGHExpat Out-of-Bounds Read via dtdCopyEPSS 0.6%CVE-2026-71980HIGHBelledonne Communications bcg729 1.1.2 Out-of-Bounds Read via decodeSIDframe()EPSS 0.6%CVE-2024-23911HIGHOut-of-bounds read vulnerability caused by improper checking of the option length values in IPv6 NDP packets exists in Cente middleware TCP/EPSS 0.6%CVE-2026-11404HIGHCesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID ParsingEPSS 0.6%CVE-2024-6443MEDIUMzephyr: out-of-bound read in utf8_truncEPSS 0.6%CVE-2023-26607HIGHIn the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.EPSS 0.6%CVE-2025-55085HIGHWeb http client: Unchecked Server-Side Malicious Packet IssueEPSS 0.6%CVE-2021-38440LOWFATEK Automation WinProladderEPSS 0.6%CVE-2022-25942HIGHAn out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead tEPSS 0.6%CVE-2022-32166MEDIUMovs - buffer over-readEPSS 0.6%CVE-2026-64762CRITICALAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7EPSS 0.6%CVE-2026-43809CRITICALAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7EPSS 0.6%CVE-2026-43757CRITICALAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7EPSS 0.6%CVE-2026-25627MEDIUMnanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining Length over WebSocketEPSS 0.6%CVE-2026-7320HIGHInformation disclosure due to incorrect boundary conditions in the Audio/Video componentEPSS 0.6%CVE-2025-43421MEDIUMMultiple issues were addressed by disabling array allocation sinking. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS TaEPSS 0.6%CVE-2026-44822HIGHMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.6%CVE-2024-54478MEDIUMAn out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.4, mEPSS 0.6%CVE-2024-10464HIGHRepeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was addressEPSS 0.6%