Falhas do tipo CWE-125

5.099 resultados

Leitura fora dos limites de memória

Ocorre quando o código tenta ler dados de uma posição de memória fora do intervalo alocado para um buffer ou array. O programa não valida o índice ou tamanho antes de acessar, causando leitura de dados inválidos, corrupção de informações ou revelação de dados sensíveis da memória adjacente.

Exemplo

Um processador de imagem PNG lê 4 bytes de um buffer de 2 bytes para validar uma assinatura, ou uma função copia uma string sem verificar se o índice fornecido pelo usuário extrapola o tamanho real do array. Em ambos os casos, dados fora do escopo pretendido são lidos.

Como mitigar

Sempre validar índices e comprimentos contra os limites reais do buffer antes de qualquer leitura. Usar funções seguras (ex: `strncpy` em vez de `strcpy`, bounds-checking em loops) e implementar testes com entradas extremas (size zero, índices negativos, valores muito grandes).

CVE-2017-13020CRITICALThe VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print().EPSS 3.3%CVE-2021-28618MEDIUMAdobe Animate out-of-bounds read vulnerability could lead to sensitive information disclosureEPSS 3.3%CVE-2019-8242MEDIUMAdobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information diEPSS 3.3%CVE-2019-8243MEDIUMAdobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information diEPSS 3.3%CVE-2019-8244MEDIUMAdobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information diEPSS 3.3%CVE-2019-8241MEDIUMAdobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information diEPSS 3.3%CVE-2017-7544—libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c cEPSS 3.3%CVE-2025-14766HIGHOut of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruptionEPSS 3.2%CVE-2017-13048CRITICALThe RSVP parser in tcpdump before 4.9.2 has a buffer over-read in print-rsvp.c:rsvp_obj_print().EPSS 3.2%CVE-2017-13055CRITICALThe ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_is_reach_subtlv().EPSS 3.2%CVE-2017-13688CRITICALThe OLSR parser in tcpdump before 4.9.2 has a buffer over-read in print-olsr.c:olsr_print().EPSS 3.2%CVE-2017-13034CRITICALThe PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print().EPSS 3.2%CVE-2017-13053CRITICALThe BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:decode_rt_routing_info().EPSS 3.2%CVE-2017-13031CRITICALThe IPv6 fragmentation header parser in tcpdump before 4.9.2 has a buffer over-read in print-frag6.c:frag6_print().EPSS 3.2%CVE-2017-13689CRITICALThe IKEv1 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:ikev1_id_print().EPSS 3.2%CVE-2017-13047CRITICALThe ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print().EPSS 3.2%CVE-2017-13054CRITICALThe LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_private_8023_print().EPSS 3.2%CVE-2017-13027CRITICALThe LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_mgmt_addr_tlv_print().EPSS 3.2%CVE-2022-28241HIGHAdobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 3.2%CVE-2021-28619MEDIUMAdobe Animate out-of-bounds read vulnerability could lead to sensitive information disclosureEPSS 3.2%