Falhas do tipo CWE-125

5.119 resultados

Leitura fora dos limites de memória

Ocorre quando o código tenta ler dados de uma posição de memória fora do intervalo alocado para um buffer ou array. O programa não valida o índice ou tamanho antes de acessar, causando leitura de dados inválidos, corrupção de informações ou revelação de dados sensíveis da memória adjacente.

Exemplo

Um processador de imagem PNG lê 4 bytes de um buffer de 2 bytes para validar uma assinatura, ou uma função copia uma string sem verificar se o índice fornecido pelo usuário extrapola o tamanho real do array. Em ambos os casos, dados fora do escopo pretendido são lidos.

Como mitigar

Sempre validar índices e comprimentos contra os limites reais do buffer antes de qualquer leitura. Usar funções seguras (ex: `strncpy` em vez de `strcpy`, bounds-checking em loops) e implementar testes com entradas extremas (size zero, índices negativos, valores muito grandes).

CVE-2025-21232MEDIUMWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-21227MEDIUMWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-21255MEDIUMWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-21258MEDIUMWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2023-23581HIGHA denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. A specEPSS 0.8%CVE-2026-69803MEDIUMWindows DHCP Server Information Disclosure VulnerabilityEPSS 0.8%CVE-2024-47774MEDIUMGHSL-2024-262: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunkEPSS 0.8%CVE-2020-6976—Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. An out-of-bounds read overflow can be exploited when a valid user openEPSS 0.8%CVE-2020-10637—Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues. A EPSS 0.8%CVE-2024-22040HIGHA vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions),EPSS 0.8%CVE-2020-7853MEDIUMTOBESOFT XPLATFORM Out-of-Bounds Read/Write VulnerabilitiesEPSS 0.8%CVE-2022-43611LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.EPSS 0.8%CVE-2018-19020—When CX-Supervisor (Versions 3.42 and prior) processes project files and tampers with the value of an offset, an attacker can force the applEPSS 0.8%CVE-2022-43615LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.EPSS 0.8%CVE-2022-43612LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Corel CorelDRAW Graphics Suite 23.EPSS 0.8%CVE-2026-42914MEDIUMWindows Kerberos Denial of Service VulnerabilityEPSS 0.8%CVE-2022-21726HIGHOut of bounds read in TensorflowEPSS 0.8%CVE-2026-39979MEDIUMjq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted BuffersEPSS 0.8%CVE-2023-51589MEDIUMBlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.8%CVE-2023-33139MEDIUMVisual Studio Information Disclosure VulnerabilityEPSS 0.8%