Weakness (CWE)
CWE-125: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How to prevent it (2 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
-
Architecture and Design
Use a language that provides appropriate memory abstractions.
Source: MITRE CWE-125
285 results · Clear filters · Feed
-
Critical 9.8CVE-2024-28515 Public exploit
Buffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary co…
-
Critical 9.8
Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the time parameter from saveParentControlInfo function.
-
Critical 9.8
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the formSetDeviceName funct…
-
Critical 9.8
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo funct…
-
Critical 9.8
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds che…
-
Critical 9.8
Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the page parameter of fromNatStaticSetting function.
-
Critical 9.8
Certain LaserJet Pro, HP Enterprise LaserJet, HP LaserJet Managed Printers – Potential Buffer Overflow, Potential Remote Code Execution
Certain HP LaserJet Pro, HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to Remote Code Execution due to buffer overflow when rendering fonts embedded in a PDF file.
-
Critical 9.1
The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obt…
-
Critical 9.1
Buffer over-read vulnerability in the dtls_sha256_update function in Contiki-NG tinyDTLS through master branch 53a0d97 …
-
Critical 9.3
Unvalidated input in Silicon Labs TrustZone implementation leads to accessing Trusted memory region
An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region.
-
Critical 9.0
Unvalidated input in Silicon Labs PSA Attestation service leads to secure memory access from non-secure memory
An unvalidated input in a library function responsible for communicating between secure and non-secure memory in Silicon Labs TrustZone implementation allows reading/writing of memory in the secure region of memory from the non-secure region of memory.
-
Critical 9.1
Tenda AX1806 V1.0.0.1 contains a stack overflow vulnerability in function sub_455D4, called by function fromSetWireless…
-
Critical 9.8
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.…
-
Critical 9.8
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-…
-
Critical 9.1
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in …
-
Critical 9.1
An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserN…
-
Critical 9.8
An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and…
-
Critical 9.6
Buffer overflow in S0 Decryption on Unify Gateway
Description: A vulnerability in SiLabs Unify Gateway 1.3.1 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.
-
Critical 9.6
Buffer overflow in S0 Decryption on Z/IP Gatweay
Description: A vulnerability in SiLabs Z/IP Gateway 7.18.01 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.
-
Critical 9.8
The facial recognition TA of some products has the out-of-bounds memory read vulnerability. Successful exploitation of …
-
Critical 9.8
Contiki-NG has off-by-one error in Antelope DBMS
Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope database management system in the Contiki-NG operating system in versions 4.8 and prior. The problem exists in the Contiki File System (CFS)…
-
Critical 9.1
The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability …
-
Critical 9.8
TensorFlow vulnerable to heap out-of-buffer read in the QuantizeAndDequantize operation
TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can access heap memory which is not in the control of user, leading to a crash or remote code execution. The fix will be included in TensorFlow ve…
-
Critical 10.0
Deno improperly handles resizable ArrayBuffer
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this h…
-
Critical 10.0
Guest-controlled out-of-bounds read/write on x86_64 in wasmtime
wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where address-mode computation mistakenly would calculate a 35-bit effective address instead of WebAssembly's defined…
-
Critical 9.1
Out-of-bounds read was discovered in YDB server. An attacker could construct a query with insert statement that would a…
-
Critical 9.8
The kernel module has an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may cause memo…
-
Critical 9.1
Patchelf out-of-bounds read
Patchelf v0.9 was discovered to contain an out-of-bounds read via the function modifyRPath at src/patchelf.cc.
-
Critical 9.8
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow…
-
Critical 9.8
In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This …
-
Critical 9.8CVE-2022-20473 Public exploit
In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This …
-
Critical 9.1
Out of Bound Read in xrdp
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarou…
-
Critical 9.1
drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request.
-
Critical 9.8
DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loadi…
-
Critical 9.1
In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 c…
-
Critical 9.1
The HW_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerabilit…
-
Critical 9.8
The HW_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerabilit…
-
Critical 9.1
The HW_KEYMASTER module has an out-of-bounds access vulnerability in parameter set verification.Successful exploitation…
-
Critical 9.1
The HW_KEYMASTER module has a vulnerability of missing bounds check on length.Successful exploitation of this vulnerabi…
-
Critical 9.1
The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a diffe…