Weakness (CWE)
CWE-125: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How to prevent it (2 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
-
Architecture and Design
Use a language that provides appropriate memory abstractions.
Source: MITRE CWE-125
2,118 results · Clear filters · Feed
-
High 8.2
zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress
zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or le…
-
High 8.2
zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset
zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the nativ…
-
High 8.6
Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni_ and no_ against the weight-matrix dimensions. During FullyConnected::Forward,…
-
High 7.1
ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header
ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio s…
-
High 7.5
An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to insufficient valida…
-
High 7.5
zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing c…
-
High 8.2
zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression di…
-
High 7.3
OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability …
-
High 8.3
Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the r…
-
High 8.8
Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code…
-
High 7.5
Windows Services for NFS ONCRPC XDR Driver Denial of Service Vulnerability
Out-of-bounds read in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to deny service over a network.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 8.8
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Windows Volume Manager Extension Driver Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Spaceport.sys Remote Code Execution Vulnerability
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally.
-
High 7.5
Windows Mobile Broadband Information Disclosure Vulnerability
Out-of-bounds read in Windows Mobile Broadband allows an unauthorized attacker to disclose information over a network.
-
High 7.8
Windows Spaceport.sys Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
-
High 7.8
Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability
Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Kerberos Denial of Service Vulnerability
Out-of-bounds read in Windows Kerberos allows an unauthorized attacker to deny service over a network.
-
High 7.8
Windows Win32k Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows exFAT File System Elevation of Privilege Vulnerability
Out-of-bounds read in Windows exFAT File System allows an authorized attacker to elevate privileges over a network.
-
High 7.0
Windows Win32k Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Spaceport.sys Remote Code Execution Vulnerability
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally.
-
High 7.8
Role: Windows Fax Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows CD-ROM Driver Elevation of Privilege Vulnerability
Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.
-
High 8.0
Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability
Out-of-bounds read in Windows VOLSNAP.SYS allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Windows LDAP - Lightweight Directory Access Protocol Denial of Service Vulnerability
Out-of-bounds read in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
-
High 8.0
Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability
Out-of-bounds read in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Windows DHCP Server Denial of Service Vulnerability
Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
-
High 7.1
Windows NTFS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Windows NTFS Elevation of Privilege Vulnerability
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges over a network.
-
High 7.5
BranchCache Denial of Service Vulnerability
Out-of-bounds read in BranchCache allows an unauthorized attacker to deny service over a network.
-
High 7.8
Windows Performance Monitor Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows NTFS Elevation of Privilege Vulnerability
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows USB Driver Elevation of Privilege Vulnerability
Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows NTFS Elevation of Privilege Vulnerability
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Trace Data Helper Elevation of Privilege Vulnerability
Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Key Distribution Center Denial of Service Vulnerability
Out-of-bounds read in Windows Key Distribution Center allows an unauthorized attacker to deny service over a network.