Falhas do tipo CWE-125

5.104 resultados

Leitura fora dos limites de memória

Ocorre quando o código tenta ler dados de uma posição de memória fora do intervalo alocado para um buffer ou array. O programa não valida o índice ou tamanho antes de acessar, causando leitura de dados inválidos, corrupção de informações ou revelação de dados sensíveis da memória adjacente.

Exemplo

Um processador de imagem PNG lê 4 bytes de um buffer de 2 bytes para validar uma assinatura, ou uma função copia uma string sem verificar se o índice fornecido pelo usuário extrapola o tamanho real do array. Em ambos os casos, dados fora do escopo pretendido são lidos.

Como mitigar

Sempre validar índices e comprimentos contra os limites reais do buffer antes de qualquer leitura. Usar funções seguras (ex: `strncpy` em vez de `strcpy`, bounds-checking em loops) e implementar testes com entradas extremas (size zero, índices negativos, valores muito grandes).

CVE-2017-12895CRITICALThe ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().EPSS 2.4%CVE-2024-20747MEDIUMTALOS-2023-1908 - Adobe Acrobat Reader Font CharStrings INDEX out-of-bounds read vulnerabilityEPSS 2.4%CVE-2023-21581MEDIUMAdobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.4%CVE-2021-31515HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID EPSS 2.4%CVE-2022-28251MEDIUMAdobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.4%CVE-2021-28569MEDIUMAdobe Media Encoder VOB file parsing out-of-bounds read could lead to information disclosure vulnerabilityEPSS 2.4%CVE-2021-28614MEDIUMAdobe After Effects Out-of-bounds Read vulnerabilityEPSS 2.4%CVE-2021-28616MEDIUMAdobe After Effects Out-of-bounds Read vulnerabilityEPSS 2.4%CVE-2021-28612MEDIUMAdobe After Effects Out-of-bounds Read vulnerabilityEPSS 2.4%CVE-2021-28611MEDIUMAdobe After Effects Out-of-bounds Read vulnerabilityEPSS 2.4%CVE-2023-38236MEDIUMZDI-CAN-21247: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.4%CVE-2023-44348MEDIUMZDI-CAN-21925: (bypass of VULN-24891) Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.4%CVE-2023-44360MEDIUMZDI-CAN-21882: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 2.4%CVE-2022-24356HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader Foxit reader 11.0.1.0719 EPSS 2.3%CVE-2024-20749MEDIUMTALOS-2023-1910 - Adobe Acrobat Reader Font CharStrings CharStringsOffset out-of-bounds read vulnerabilityEPSS 2.3%CVE-2024-20735MEDIUMTALOS-2023-1905 - Adobe Acrobat Reader Font CPAL numColorRecords out-of-bounds read vulnerabilityEPSS 2.3%CVE-2024-20748MEDIUMTALOS-2023-1909 - Adobe Acrobat Reader Font avar SegmentMaps out-of-bounds read vulnerabilityEPSS 2.3%CVE-2021-40716MEDIUMXMP Toolkit SDK SVG_Adapter Out-of-bounds Read Information DisclosureEPSS 2.3%CVE-2024-28938HIGHMicrosoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.3%CVE-2024-1869HIGHCertain HP DesignJet print products are potentially vulnerable to information disclosure related to accessing memory out-of-bounds when usinEPSS 2.3%