Falhas do tipo CWE-125

5.094 resultados

Leitura fora dos limites de memória

Ocorre quando o código tenta ler dados de uma posição de memória fora do intervalo alocado para um buffer ou array. O programa não valida o índice ou tamanho antes de acessar, causando leitura de dados inválidos, corrupção de informações ou revelação de dados sensíveis da memória adjacente.

Exemplo

Um processador de imagem PNG lê 4 bytes de um buffer de 2 bytes para validar uma assinatura, ou uma função copia uma string sem verificar se o índice fornecido pelo usuário extrapola o tamanho real do array. Em ambos os casos, dados fora do escopo pretendido são lidos.

Como mitigar

Sempre validar índices e comprimentos contra os limites reais do buffer antes de qualquer leitura. Usar funções seguras (ex: `strncpy` em vez de `strcpy`, bounds-checking em loops) e implementar testes com entradas extremas (size zero, índices negativos, valores muito grandes).

CVE-2021-44715LOWAdobe Acrobat Reader DC Out-of-Bounds Read Information Disclosure VulnerabilityEPSS 14.7%CVE-2023-28204MEDIUMAn out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 1EPSS 14.3%KEVCVE-2024-28640HIGHBuffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause EPSS 14.2%CVE-2024-3156HIGHInappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds mEPSS 12.9%CVE-2023-36424HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 12.2%KEVCVE-1999-0006CRITICALBuffer overflow in POP servers based on BSD/Qualcomm's qpopper allows remote attackers to gain root access using a long PASS command.EPSS 12.1%CVE-2023-4428HIGHOut of bounds memory access in CSS in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory reaEPSS 11.3%CVE-2020-8880HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interacEPSS 11.1%CVE-2022-28243HIGHAdobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 11.0%CVE-2020-11910CRITICALThe Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.EPSS 10.9%CVE-2017-8817CRITICALThe FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and appEPSS 10.9%CVE-2022-28246MEDIUMAdobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 10.1%CVE-2022-28258MEDIUMAdobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 10.1%CVE-2022-28263MEDIUMAdobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 10.0%CVE-2022-28262MEDIUMAdobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 10.0%CVE-2022-28248MEDIUMAdobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 9.8%CVE-2025-4918CRITICALOut-of-bounds access when resolving Promise objectsEPSS 9.4%CVE-2022-28252LOWAdobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 9.3%CVE-2020-7060MEDIUMglobal buffer-overflow in mbfl_filt_conv_big5_wcharEPSS 8.9%CVE-2022-20473CRITICALIn toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote EPSS 8.9%