Falhas do tipo CWE-125

5.126 resultados

Leitura fora dos limites de memória

Ocorre quando o código tenta ler dados de uma posição de memória fora do intervalo alocado para um buffer ou array. O programa não valida o índice ou tamanho antes de acessar, causando leitura de dados inválidos, corrupção de informações ou revelação de dados sensíveis da memória adjacente.

Exemplo

Um processador de imagem PNG lê 4 bytes de um buffer de 2 bytes para validar uma assinatura, ou uma função copia uma string sem verificar se o índice fornecido pelo usuário extrapola o tamanho real do array. Em ambos os casos, dados fora do escopo pretendido são lidos.

Como mitigar

Sempre validar índices e comprimentos contra os limites reais do buffer antes de qualquer leitura. Usar funções seguras (ex: `strncpy` em vez de `strcpy`, bounds-checking em loops) e implementar testes com entradas extremas (size zero, índices negativos, valores muito grandes).

CVE-2026-37461HIGHAn out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) viaEPSS 0.6%CVE-2026-76641HIGHExpat Out-of-Bounds Read via dtdCopyEPSS 0.6%CVE-2026-71980HIGHBelledonne Communications bcg729 1.1.2 Out-of-Bounds Read via decodeSIDframe()EPSS 0.6%CVE-2024-23911HIGHOut-of-bounds read vulnerability caused by improper checking of the option length values in IPv6 NDP packets exists in Cente middleware TCP/EPSS 0.6%CVE-2026-11404HIGHCesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID ParsingEPSS 0.6%CVE-2024-6443MEDIUMzephyr: out-of-bound read in utf8_truncEPSS 0.6%CVE-2023-26607HIGHIn the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.EPSS 0.6%CVE-2025-55085HIGHWeb http client: Unchecked Server-Side Malicious Packet IssueEPSS 0.6%CVE-2021-38440LOWFATEK Automation WinProladderEPSS 0.6%CVE-2022-25942HIGHAn out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead tEPSS 0.6%CVE-2022-32166MEDIUMovs - buffer over-readEPSS 0.6%CVE-2026-64762CRITICALAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7EPSS 0.6%CVE-2026-43809CRITICALAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7EPSS 0.6%CVE-2026-43757CRITICALAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7EPSS 0.6%CVE-2026-25627MEDIUMnanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining Length over WebSocketEPSS 0.6%CVE-2026-7320HIGHInformation disclosure due to incorrect boundary conditions in the Audio/Video componentEPSS 0.6%CVE-2025-43421MEDIUMMultiple issues were addressed by disabling array allocation sinking. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS TaEPSS 0.6%CVE-2026-44822HIGHMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.6%CVE-2024-54478MEDIUMAn out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.4, mEPSS 0.6%CVE-2024-10464HIGHRepeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was addressEPSS 0.6%