Falhas do tipo CWE-125

5.094 resultados

Leitura fora dos limites de memória

Ocorre quando o código tenta ler dados de uma posição de memória fora do intervalo alocado para um buffer ou array. O programa não valida o índice ou tamanho antes de acessar, causando leitura de dados inválidos, corrupção de informações ou revelação de dados sensíveis da memória adjacente.

Exemplo

Um processador de imagem PNG lê 4 bytes de um buffer de 2 bytes para validar uma assinatura, ou uma função copia uma string sem verificar se o índice fornecido pelo usuário extrapola o tamanho real do array. Em ambos os casos, dados fora do escopo pretendido são lidos.

Como mitigar

Sempre validar índices e comprimentos contra os limites reais do buffer antes de qualquer leitura. Usar funções seguras (ex: `strncpy` em vez de `strcpy`, bounds-checking em loops) e implementar testes com entradas extremas (size zero, índices negativos, valores muito grandes).

CVE-2019-3859CRITICALAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A rEPSS 6.3%CVE-2024-6779HIGHOut of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escapeEPSS 6.3%CVE-2018-1000301CRITICALcurl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can resulEPSS 6.0%CVE-2021-44742LOWAdobe Reader Out-of-bounds Read Remote Code Execution VulnerabilityEPSS 5.9%CVE-2024-9143MEDIUMLow-level invalid GF(2^m) parameters lead to OOB memory accessEPSS 5.8%CVE-2024-5535CRITICALSSL_select_next_proto buffer overreadEPSS 5.6%CVE-2023-35386HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 5.5%CVE-2019-17136HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interacEPSS 5.5%CVE-2020-14364—An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processiEPSS 5.4%CVE-2025-55681HIGHDesktop Window Manager Elevation of Privilege VulnerabilityEPSS 5.4%CVE-2021-3522MEDIUMGStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.EPSS 5.4%CVE-2018-16890MEDIUMlibcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 EPSS 5.4%CVE-2024-30037MEDIUMWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 5.3%CVE-2016-8621MEDIUMThe `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit shorEPSS 5.2%CVE-2024-34950HIGHD-Link DIR-822+ v1.0.5 was discovered to contain a stack-based buffer overflow vulnerability in the SetNetworkTomographySettings module.EPSS 5.2%CVE-2019-3860MEDIUMAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker EPSS 5.1%CVE-2019-3861MEDIUMAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packetEPSS 5.1%CVE-2023-24902HIGHWin32k Elevation of Privilege VulnerabilityEPSS 5.1%CVE-2022-34226HIGHAdobe Acrobat Reader DC PDF Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 5.0%CVE-2019-13331HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interactionEPSS 5.0%