Falhas do tipo CWE-125

5.126 resultados

Leitura fora dos limites de memória

Ocorre quando o código tenta ler dados de uma posição de memória fora do intervalo alocado para um buffer ou array. O programa não valida o índice ou tamanho antes de acessar, causando leitura de dados inválidos, corrupção de informações ou revelação de dados sensíveis da memória adjacente.

Exemplo

Um processador de imagem PNG lê 4 bytes de um buffer de 2 bytes para validar uma assinatura, ou uma função copia uma string sem verificar se o índice fornecido pelo usuário extrapola o tamanho real do array. Em ambos os casos, dados fora do escopo pretendido são lidos.

Como mitigar

Sempre validar índices e comprimentos contra os limites reais do buffer antes de qualquer leitura. Usar funções seguras (ex: `strncpy` em vez de `strcpy`, bounds-checking em loops) e implementar testes com entradas extremas (size zero, índices negativos, valores muito grandes).

CVE-2026-43112HIGHfs/smb/client: fix out-of-bounds read in cifs_sanitize_prepathEPSS 0.7%CVE-2021-38451MEDIUMAUVESY VersiondogEPSS 0.7%CVE-2022-3447MEDIUMInappropriate implementation in Custom Tabs in Google Chrome on Android prior to 106.0.5249.119 allowed a remote attacker to spoof the conteEPSS 0.7%CVE-2022-41977MEDIUMAn out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files. A speciallyEPSS 0.7%CVE-2026-35423MEDIUMWindows 11 Telnet Client Information Disclosure VulnerabilityEPSS 0.7%CVE-2022-39317MEDIUMOut of bounds read in zgfx decoder in FreeRDPEPSS 0.7%CVE-2024-29994HIGHMicrosoft Windows SCSI Class System File Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2023-3646MEDIUMOn affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.EPSS 0.7%CVE-2026-34824HIGHMesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of ServiceEPSS 0.7%CVE-2023-39176MEDIUMKernel: ksmbd: transform header out-of-bounds read information disclosure vulnerabilityEPSS 0.7%CVE-2026-76151MEDIUMOut-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module)EPSS 0.7%CVE-2022-28228CRITICALOut-of-bounds read was discovered in YDB server. An attacker could construct a query with insert statement that would allow him to read sensEPSS 0.7%CVE-2026-85455HIGHMOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short PacketEPSS 0.7%CVE-2025-15646CRITICALHTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusionEPSS 0.7%CVE-2026-41475HIGHBACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag ParserEPSS 0.7%CVE-2025-24987MEDIUMWindows USB Video Class System Driver Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2024-7966HIGHOut of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer proceEPSS 0.7%CVE-2024-3859MEDIUMOn 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenTypEPSS 0.7%CVE-2025-24988MEDIUMWindows USB Video Class System Driver Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-20946HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.7%