Falhas do tipo CWE-125

5.136 resultados

Leitura fora dos limites de memória

Ocorre quando o código tenta ler dados de uma posição de memória fora do intervalo alocado para um buffer ou array. O programa não valida o índice ou tamanho antes de acessar, causando leitura de dados inválidos, corrupção de informações ou revelação de dados sensíveis da memória adjacente.

Exemplo

Um processador de imagem PNG lê 4 bytes de um buffer de 2 bytes para validar uma assinatura, ou uma função copia uma string sem verificar se o índice fornecido pelo usuário extrapola o tamanho real do array. Em ambos os casos, dados fora do escopo pretendido são lidos.

Como mitigar

Sempre validar índices e comprimentos contra os limites reais do buffer antes de qualquer leitura. Usar funções seguras (ex: `strncpy` em vez de `strcpy`, bounds-checking em loops) e implementar testes com entradas extremas (size zero, índices negativos, valores muito grandes).

CVE-2024-27324LOWPDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-21143MEDIUMVulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). Supported versions that are affected arEPSS 0.4%CVE-2026-17649MEDIUMIBM i is Affected By Multiple Vulnerabilities in NetServerEPSS 0.4%CVE-2026-16859MEDIUMIBM i is Affected By Multiple Vulnerabilities in NetServerEPSS 0.4%CVE-2026-66034HIGHlibssh2 Heap Out-of-Bounds Read via publickey subsystemEPSS 0.4%CVE-2025-62457HIGHWindows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-16833MEDIUMVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.4%CVE-2026-91950HIGHFreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 WraparoundEPSS 0.4%CVE-2022-35672HIGHAdobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-24911MEDIUMOut of Bounds read in the CPCA process on Check Point Management ServerEPSS 0.4%CVE-2023-37347HIGHKofax Power PDF U3D File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-62572HIGHApplication Information Service Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2023-35716HIGHAshlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-47071MEDIUMZDI-CAN-21704: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.4%CVE-2023-37354HIGHKofax Power PDF PNG File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-55233HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-11534HIGHIrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-34303HIGHAshlar-Vellum Cobalt Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-12969MEDIUMDnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validationEPSS 0.4%CVE-2024-50600HIGHAn issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1EPSS 0.4%