Falhas do tipo CWE-125

5.126 resultados

Leitura fora dos limites de memória

Ocorre quando o código tenta ler dados de uma posição de memória fora do intervalo alocado para um buffer ou array. O programa não valida o índice ou tamanho antes de acessar, causando leitura de dados inválidos, corrupção de informações ou revelação de dados sensíveis da memória adjacente.

Exemplo

Um processador de imagem PNG lê 4 bytes de um buffer de 2 bytes para validar uma assinatura, ou uma função copia uma string sem verificar se o índice fornecido pelo usuário extrapola o tamanho real do array. Em ambos os casos, dados fora do escopo pretendido são lidos.

Como mitigar

Sempre validar índices e comprimentos contra os limites reais do buffer antes de qualquer leitura. Usar funções seguras (ex: `strncpy` em vez de `strcpy`, bounds-checking em loops) e implementar testes com entradas extremas (size zero, índices negativos, valores muito grandes).

CVE-2022-47630HIGHTrusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of gEPSS 0.6%CVE-2021-31354HIGHJunos OS and Junos OS Evolved: A vulnerability in the Juniper Agile License Client may allow an attacker to perform Remote Code Execution (RCE)EPSS 0.6%CVE-2024-27282MEDIUMAn issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extraEPSS 0.6%CVE-2026-92240CRITICALOut-of-bounds read in IMAP response parserEPSS 0.6%CVE-2026-52719HIGHGstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoderEPSS 0.6%CVE-2024-56627HIGHksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_readEPSS 0.6%CVE-2025-0908LOWPDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.6%CVE-2022-39392MEDIUMWasmtime vulnerable to out of bounds read/write with zero-memory-pages configurationEPSS 0.6%CVE-2026-90775HIGHPostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule WeightEPSS 0.6%CVE-2026-78049MEDIUMSysterel S2OPC AddNodes Service sopc_node_mgt_helper_internal.c out-of-boundsEPSS 0.6%CVE-2022-31812HIGHA vulnerability has been identified in SiPass integrated (All versions < V2.95.3.18). Affected server applications contain an out of bounds EPSS 0.6%CVE-2021-42374MEDIUMAn out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is EPSS 0.6%CVE-2025-30174HIGHA vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < VEPSS 0.6%CVE-2025-30176HIGHA vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < VEPSS 0.6%CVE-2025-64656CRITICALAzure Application Gateway Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-27596LOWExiv2: Integer Underflow in LoaderNative::getData() Causes Heap Buffer OverflowEPSS 0.6%CVE-2026-32605HIGHNimiq: Remote crash via off-by-one signer bounds check in proposal bufferEPSS 0.6%CVE-2026-90560HIGHzstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompressEPSS 0.6%CVE-2025-54950CRITICALAn out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execEPSS 0.6%CVE-2026-21258MEDIUMMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.6%